@westbayberry/dg 1.0.34 → 1.0.35

package/dist/index.mjs

@@ -38,6 +38,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
   mod
 ));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/auth.ts
 var auth_exports = {};
@@ -249,28 +250,46 @@ function getVersion() {
     return "1.0.0";
   }
 }
-function parseConfig(argv) {
-  const { values, positionals } = parseArgs({
-    args: argv.slice(2),
-    options: {
-      "api-url": { type: "string" },
-      mode: { type: "string" },
-      "block-threshold": { type: "string" },
-      "warn-threshold": { type: "string" },
-      "max-packages": { type: "string" },
-      allowlist: { type: "string" },
-      json: { type: "boolean", default: false },
-      "scan-all": { type: "boolean", default: false },
-      "base-lockfile": { type: "string" },
-      workspace: { type: "string", short: "w" },
-      debug: { type: "boolean", default: false },
-      "no-config": { type: "boolean", default: false },
-      help: { type: "boolean", default: false },
-      version: { type: "boolean", default: false }
-    },
-    allowPositionals: true,
-    strict: false
-  });
+function parseConfig(argv, strictFlags = true) {
+  let values;
+  let positionals;
+  try {
+    const parsed = parseArgs({
+      args: argv.slice(2),
+      options: {
+        "api-url": { type: "string" },
+        mode: { type: "string" },
+        "max-packages": { type: "string" },
+        json: { type: "boolean", default: false },
+        "scan-all": { type: "boolean", default: false },
+        "base-lockfile": { type: "string" },
+        workspace: { type: "string", short: "w" },
+        debug: { type: "boolean", default: false },
+        help: { type: "boolean", default: false },
+        version: { type: "boolean", default: false },
+        // Recognized but handled server-side via policy dashboard
+        "no-config": { type: "boolean", default: false },
+        allowlist: { type: "string" },
+        "block-threshold": { type: "string" },
+        "warn-threshold": { type: "string" }
+      },
+      allowPositionals: true,
+      strict: strictFlags
+    });
+    values = parsed.values;
+    positionals = parsed.positionals;
+  } catch (err) {
+    const raw = err instanceof Error ? err.message : String(err);
+    const match = raw.match(/Unknown option '([^']+)'/);
+    const msg = match ? `Unknown option '${match[1]}'.` : raw;
+    process.stderr.write(`
+  Error: ${msg}
+`);
+    process.stderr.write(`  Run 'dg --help' for available options.
+
+`);
+    process.exit(1);
+  }
   if (values.help) {
     process.stdout.write(USAGE);
     process.exit(0);
@@ -281,8 +300,7 @@ function parseConfig(argv) {
     process.exit(0);
   }
   const command = positionals[0] ?? "scan";
-  const noConfig = values["no-config"];
-  const dgrc = noConfig ? {} : loadDgrc();
+  const dgrc = loadDgrc();
   const apiKey = dgrc.apiKey && typeof dgrc.apiKey === "string" && dgrc.apiKey.startsWith("dg_live_") ? dgrc.apiKey : null;
   const deviceId = getOrCreateDeviceId();
   const modeRaw = values.mode ?? process.env.DG_MODE ?? dgrc.mode ?? "warn";
@@ -293,19 +311,8 @@ function parseConfig(argv) {
     );
     process.exit(1);
   }
-  const allowlistRaw = values.allowlist ?? process.env.DG_ALLOWLIST ?? "";
-  const blockThreshold = Number(values["block-threshold"] ?? dgrc.blockThreshold ?? "70");
-  const warnThreshold = Number(values["warn-threshold"] ?? dgrc.warnThreshold ?? "60");
   const maxPackages = Number(values["max-packages"] ?? dgrc.maxPackages ?? "200");
   const debug = values.debug || process.env.DG_DEBUG === "1";
-  if (isNaN(blockThreshold) || blockThreshold < 0 || blockThreshold > 100) {
-    process.stderr.write("Error: --block-threshold must be a number between 0 and 100\n");
-    process.exit(1);
-  }
-  if (isNaN(warnThreshold) || warnThreshold < 0 || warnThreshold > 100) {
-    process.stderr.write("Error: --warn-threshold must be a number between 0 and 100\n");
-    process.exit(1);
-  }
   if (isNaN(maxPackages) || maxPackages < 1 || maxPackages > 1e4) {
     process.stderr.write("Error: --max-packages must be a number between 1 and 10000\n");
     process.exit(1);
@@ -317,10 +324,7 @@ function parseConfig(argv) {
       values["api-url"] ?? process.env.DG_API_URL ?? dgrc.apiUrl ?? "https://api.westbayberry.com"
     ),
     mode: modeRaw,
-    blockThreshold,
-    warnThreshold,
     maxPackages,
-    allowlist: (allowlistRaw ? allowlistRaw.split(",").map((s) => s.trim()).filter(Boolean) : dgrc.allowlist ?? []).map((s) => s.toLowerCase()),
     json: values.json,
     scanAll: values["scan-all"],
     baseLockfile: values["base-lockfile"] ?? null,
@@ -341,11 +345,13 @@ var init_config = __esm({
     dependency-guardian scan [options]
     dg scan [options]
     dg npm install <pkg> [npm-flags]
+    dg pip install <pkg> [pip-flags]
     dg wrap
 
   Commands:
     scan            Scan dependencies (auto-discovers npm + Python projects)
     npm             Wrap npm commands \u2014 scans packages before installing
+    pip             Wrap pip commands \u2014 scans packages before installing
     hook install    Install git pre-commit hook to scan lockfile changes
     hook uninstall  Remove the pre-commit hook
     update          Check for and install the latest version
@@ -356,16 +362,12 @@ var init_config = __esm({
   Options:
     --api-url <url>          API base URL (default: https://api.westbayberry.com)
     --mode <mode>            block | warn | off (default: warn)
-    --block-threshold <n>    Score threshold for blocking (default: 70)
-    --warn-threshold <n>     Score threshold for warnings (default: 60)
     --max-packages <n>       Max packages per scan (default: 200)
-    --allowlist <pkgs>       Comma-separated package names to skip
     --json                   Output JSON for CI parsing
     --scan-all               Scan all packages, not just changed
     --base-lockfile <path>   Path to base lockfile for explicit diff
     --workspace <dir>        Scan a specific workspace subdirectory
     --debug                  Show diagnostic output (discovery, batches, timing)
-    --no-config              Skip loading .dgrc.json config file
     --help                   Show this help message
     --version                Show version number
 
@@ -376,7 +378,6 @@ var init_config = __esm({
   Environment Variables:
     DG_API_URL               API base URL
     DG_MODE                  Mode (block/warn/off)
-    DG_ALLOWLIST             Comma-separated allowlist
     DG_DEBUG                 Enable debug output (set to 1)
     DG_WORKSPACE             Workspace subdirectory to scan
 
@@ -3469,15 +3470,15 @@ var require_react_development = __commonJS({
           var dispatcher = resolveDispatcher();
           return dispatcher.useState(initialState);
         }
-        function useReducer5(reducer4, initialArg, init) {
+        function useReducer6(reducer5, initialArg, init) {
           var dispatcher = resolveDispatcher();
-          return dispatcher.useReducer(reducer4, initialArg, init);
+          return dispatcher.useReducer(reducer5, initialArg, init);
         }
-        function useRef8(initialValue) {
+        function useRef9(initialValue) {
           var dispatcher = resolveDispatcher();
           return dispatcher.useRef(initialValue);
         }
-        function useEffect14(create2, deps) {
+        function useEffect16(create2, deps) {
           var dispatcher = resolveDispatcher();
           return dispatcher.useEffect(create2, deps);
         }
@@ -3489,7 +3490,7 @@ var require_react_development = __commonJS({
           var dispatcher = resolveDispatcher();
           return dispatcher.useLayoutEffect(create2, deps);
         }
-        function useCallback5(callback, deps) {
+        function useCallback6(callback, deps) {
           var dispatcher = resolveDispatcher();
           return dispatcher.useCallback(callback, deps);
         }
@@ -4256,18 +4257,18 @@ var require_react_development = __commonJS({
         exports.memo = memo;
         exports.startTransition = startTransition;
         exports.unstable_act = act;
-        exports.useCallback = useCallback5;
+        exports.useCallback = useCallback6;
         exports.useContext = useContext7;
         exports.useDebugValue = useDebugValue;
         exports.useDeferredValue = useDeferredValue;
-        exports.useEffect = useEffect14;
+        exports.useEffect = useEffect16;
         exports.useId = useId;
         exports.useImperativeHandle = useImperativeHandle;
         exports.useInsertionEffect = useInsertionEffect;
         exports.useLayoutEffect = useLayoutEffect2;
         exports.useMemo = useMemo4;
-        exports.useReducer = useReducer5;
-        exports.useRef = useRef8;
+        exports.useReducer = useReducer6;
+        exports.useRef = useRef9;
         exports.useState = useState9;
         exports.useSyncExternalStore = useSyncExternalStore;
         exports.useTransition = useTransition;
@@ -11978,9 +11979,9 @@ var require_react_reconciler_development = __commonJS({
       module.exports = function $$$reconciler($$$hostConfig) {
         var exports2 = {};
         "use strict";
-        var React17 = require_react();
+        var React18 = require_react();
         var Scheduler = require_scheduler();
-        var ReactSharedInternals = React17.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED;
+        var ReactSharedInternals = React18.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED;
         var suppressWarning = false;
         function setSuppressWarning(newSuppressWarning) {
           {
@@ -12044,7 +12045,7 @@ var require_react_reconciler_development = __commonJS({
         var HostPortal = 4;
         var HostComponent = 5;
         var HostText = 6;
-        var Fragment4 = 7;
+        var Fragment7 = 7;
         var Mode = 8;
         var ContextConsumer = 9;
         var ContextProvider = 10;
@@ -12184,7 +12185,7 @@ var require_react_reconciler_development = __commonJS({
               return "DehydratedFragment";
             case ForwardRef:
               return getWrappedName$1(type, type.render, "ForwardRef");
-            case Fragment4:
+            case Fragment7:
               return "Fragment";
             case HostComponent:
               return type;
@@ -15318,7 +15319,7 @@ var require_react_reconciler_development = __commonJS({
             }
           }
           function updateFragment2(returnFiber, current2, fragment, lanes, key) {
-            if (current2 === null || current2.tag !== Fragment4) {
+            if (current2 === null || current2.tag !== Fragment7) {
               var created = createFiberFromFragment(fragment, returnFiber.mode, lanes, key);
               created.return = returnFiber;
               return created;
@@ -15721,7 +15722,7 @@ var require_react_reconciler_development = __commonJS({
               if (child.key === key) {
                 var elementType = element.type;
                 if (elementType === REACT_FRAGMENT_TYPE) {
-                  if (child.tag === Fragment4) {
+                  if (child.tag === Fragment7) {
                     deleteRemainingChildren(returnFiber, child.sibling);
                     var existing = useFiber(child, element.props.children);
                     existing.return = returnFiber;
@@ -16969,7 +16970,7 @@ var require_react_reconciler_development = __commonJS({
         function basicStateReducer(state, action) {
           return typeof action === "function" ? action(state) : action;
         }
-        function mountReducer(reducer4, initialArg, init) {
+        function mountReducer(reducer5, initialArg, init) {
           var hook = mountWorkInProgressHook();
           var initialState;
           if (init !== void 0) {
@@ -16983,20 +16984,20 @@ var require_react_reconciler_development = __commonJS({
             interleaved: null,
             lanes: NoLanes,
             dispatch: null,
-            lastRenderedReducer: reducer4,
+            lastRenderedReducer: reducer5,
             lastRenderedState: initialState
           };
           hook.queue = queue;
           var dispatch = queue.dispatch = dispatchReducerAction.bind(null, currentlyRenderingFiber$1, queue);
           return [hook.memoizedState, dispatch];
         }
-        function updateReducer(reducer4, initialArg, init) {
+        function updateReducer(reducer5, initialArg, init) {
           var hook = updateWorkInProgressHook();
           var queue = hook.queue;
           if (queue === null) {
             throw new Error("Should have a queue. This is likely a bug in React. Please file an issue.");
           }
-          queue.lastRenderedReducer = reducer4;
+          queue.lastRenderedReducer = reducer5;
           var current2 = currentHook;
           var baseQueue = current2.baseQueue;
           var pendingQueue = queue.pending;
@@ -17058,7 +17059,7 @@ var require_react_reconciler_development = __commonJS({
                   newState = update.eagerState;
                 } else {
                   var action = update.action;
-                  newState = reducer4(newState, action);
+                  newState = reducer5(newState, action);
                 }
               }
               update = update.next;
@@ -17091,13 +17092,13 @@ var require_react_reconciler_development = __commonJS({
           var dispatch = queue.dispatch;
           return [hook.memoizedState, dispatch];
         }
-        function rerenderReducer(reducer4, initialArg, init) {
+        function rerenderReducer(reducer5, initialArg, init) {
           var hook = updateWorkInProgressHook();
           var queue = hook.queue;
           if (queue === null) {
             throw new Error("Should have a queue. This is likely a bug in React. Please file an issue.");
           }
-          queue.lastRenderedReducer = reducer4;
+          queue.lastRenderedReducer = reducer5;
           var dispatch = queue.dispatch;
           var lastRenderPhaseUpdate = queue.pending;
           var newState = hook.memoizedState;
@@ -17107,7 +17108,7 @@ var require_react_reconciler_development = __commonJS({
             var update = firstRenderPhaseUpdate;
             do {
               var action = update.action;
-              newState = reducer4(newState, action);
+              newState = reducer5(newState, action);
               update = update.next;
             } while (update !== firstRenderPhaseUpdate);
             if (!objectIs(newState, hook.memoizedState)) {
@@ -17787,13 +17788,13 @@ var require_react_reconciler_development = __commonJS({
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
             },
-            useReducer: function(reducer4, initialArg, init) {
+            useReducer: function(reducer5, initialArg, init) {
               currentHookNameInDev = "useReducer";
               mountHookTypesDev();
               var prevDispatcher = ReactCurrentDispatcher$1.current;
               ReactCurrentDispatcher$1.current = InvalidNestedHooksDispatcherOnMountInDEV;
               try {
-                return mountReducer(reducer4, initialArg, init);
+                return mountReducer(reducer5, initialArg, init);
               } finally {
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
@@ -17891,13 +17892,13 @@ var require_react_reconciler_development = __commonJS({
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
             },
-            useReducer: function(reducer4, initialArg, init) {
+            useReducer: function(reducer5, initialArg, init) {
               currentHookNameInDev = "useReducer";
               updateHookTypesDev();
               var prevDispatcher = ReactCurrentDispatcher$1.current;
               ReactCurrentDispatcher$1.current = InvalidNestedHooksDispatcherOnMountInDEV;
               try {
-                return mountReducer(reducer4, initialArg, init);
+                return mountReducer(reducer5, initialArg, init);
               } finally {
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
@@ -17995,13 +17996,13 @@ var require_react_reconciler_development = __commonJS({
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
             },
-            useReducer: function(reducer4, initialArg, init) {
+            useReducer: function(reducer5, initialArg, init) {
               currentHookNameInDev = "useReducer";
               updateHookTypesDev();
               var prevDispatcher = ReactCurrentDispatcher$1.current;
               ReactCurrentDispatcher$1.current = InvalidNestedHooksDispatcherOnUpdateInDEV;
               try {
-                return updateReducer(reducer4, initialArg, init);
+                return updateReducer(reducer5, initialArg, init);
               } finally {
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
@@ -18099,13 +18100,13 @@ var require_react_reconciler_development = __commonJS({
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
             },
-            useReducer: function(reducer4, initialArg, init) {
+            useReducer: function(reducer5, initialArg, init) {
               currentHookNameInDev = "useReducer";
               updateHookTypesDev();
               var prevDispatcher = ReactCurrentDispatcher$1.current;
               ReactCurrentDispatcher$1.current = InvalidNestedHooksDispatcherOnRerenderInDEV;
               try {
-                return rerenderReducer(reducer4, initialArg, init);
+                return rerenderReducer(reducer5, initialArg, init);
               } finally {
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
@@ -18211,14 +18212,14 @@ var require_react_reconciler_development = __commonJS({
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
             },
-            useReducer: function(reducer4, initialArg, init) {
+            useReducer: function(reducer5, initialArg, init) {
               currentHookNameInDev = "useReducer";
               warnInvalidHookAccess();
               mountHookTypesDev();
               var prevDispatcher = ReactCurrentDispatcher$1.current;
               ReactCurrentDispatcher$1.current = InvalidNestedHooksDispatcherOnMountInDEV;
               try {
-                return mountReducer(reducer4, initialArg, init);
+                return mountReducer(reducer5, initialArg, init);
               } finally {
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
@@ -18332,14 +18333,14 @@ var require_react_reconciler_development = __commonJS({
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
             },
-            useReducer: function(reducer4, initialArg, init) {
+            useReducer: function(reducer5, initialArg, init) {
               currentHookNameInDev = "useReducer";
               warnInvalidHookAccess();
               updateHookTypesDev();
               var prevDispatcher = ReactCurrentDispatcher$1.current;
               ReactCurrentDispatcher$1.current = InvalidNestedHooksDispatcherOnUpdateInDEV;
               try {
-                return updateReducer(reducer4, initialArg, init);
+                return updateReducer(reducer5, initialArg, init);
               } finally {
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
@@ -18453,14 +18454,14 @@ var require_react_reconciler_development = __commonJS({
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
             },
-            useReducer: function(reducer4, initialArg, init) {
+            useReducer: function(reducer5, initialArg, init) {
               currentHookNameInDev = "useReducer";
               warnInvalidHookAccess();
               updateHookTypesDev();
               var prevDispatcher = ReactCurrentDispatcher$1.current;
               ReactCurrentDispatcher$1.current = InvalidNestedHooksDispatcherOnUpdateInDEV;
               try {
-                return rerenderReducer(reducer4, initialArg, init);
+                return rerenderReducer(reducer5, initialArg, init);
               } finally {
                 ReactCurrentDispatcher$1.current = prevDispatcher;
               }
@@ -21212,7 +21213,7 @@ var require_react_reconciler_development = __commonJS({
               var _resolvedProps2 = workInProgress2.elementType === type ? _unresolvedProps2 : resolveDefaultProps(type, _unresolvedProps2);
               return updateForwardRef(current2, workInProgress2, type, _resolvedProps2, renderLanes2);
             }
-            case Fragment4:
+            case Fragment7:
               return updateFragment(current2, workInProgress2, renderLanes2);
             case Mode:
               return updateMode(current2, workInProgress2, renderLanes2);
@@ -21649,7 +21650,7 @@ var require_react_reconciler_development = __commonJS({
             case SimpleMemoComponent:
             case FunctionComponent:
             case ForwardRef:
-            case Fragment4:
+            case Fragment7:
             case Mode:
             case Profiler:
             case ContextConsumer:
@@ -26417,7 +26418,7 @@ var require_react_reconciler_development = __commonJS({
           return fiber;
         }
         function createFiberFromFragment(elements, mode, lanes, key) {
-          var fiber = createFiber(Fragment4, elements, key, mode);
+          var fiber = createFiber(Fragment7, elements, key, mode);
           fiber.lanes = lanes;
           return fiber;
         }
@@ -37931,7 +37932,7 @@ var require_react_jsx_runtime_development = __commonJS({
     if (process.env.NODE_ENV !== "production") {
       (function() {
         "use strict";
-        var React17 = require_react();
+        var React18 = require_react();
         var REACT_ELEMENT_TYPE = Symbol.for("react.element");
         var REACT_PORTAL_TYPE = Symbol.for("react.portal");
         var REACT_FRAGMENT_TYPE = Symbol.for("react.fragment");
@@ -37957,7 +37958,7 @@ var require_react_jsx_runtime_development = __commonJS({
           }
           return null;
         }
-        var ReactSharedInternals = React17.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED;
+        var ReactSharedInternals = React18.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED;
         function error(format) {
           {
             {
@@ -38807,11 +38808,11 @@ var require_react_jsx_runtime_development = __commonJS({
             return jsxWithValidation(type, props, key, false);
           }
         }
-        var jsx11 = jsxWithValidationDynamic;
-        var jsxs13 = jsxWithValidationStatic;
+        var jsx12 = jsxWithValidationDynamic;
+        var jsxs14 = jsxWithValidationStatic;
         exports.Fragment = REACT_FRAGMENT_TYPE;
-        exports.jsx = jsx11;
-        exports.jsxs = jsxs13;
+        exports.jsx = jsx12;
+        exports.jsxs = jsxs14;
       })();
     }
   }
@@ -39030,7 +39031,7 @@ async function callAnalyzeAPI(packages, config, onProgress) {
     results.push(result);
   }
   if (process.env.DG_PERF) console.error(`[CLI-PERF] total: ${packages.length} packages \u2192 ${Date.now() - tTotal}ms`);
-  return mergeResponses(results, config);
+  return mergeResponses(results);
 }
 async function callBatchWithRetry(packages, config) {
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
@@ -39053,10 +39054,10 @@ async function callBatchWithRetry(packages, config) {
   }
   throw new Error("Exhausted retries");
 }
-function mergeResponses(results, config) {
+function mergeResponses(results) {
   const allPackages = results.flatMap((r) => r.packages);
   const maxScore = Math.max(0, ...allPackages.map((p) => p.score));
-  const action = maxScore >= config.blockThreshold ? "block" : maxScore >= config.warnThreshold ? "warn" : "pass";
+  const action = maxScore >= 70 ? "block" : maxScore >= 60 ? "warn" : "pass";
   const safeVersions = {};
   for (const r of results) {
     Object.assign(safeVersions, r.safeVersions);
@@ -39077,11 +39078,7 @@ async function callAnalyzeBatch(packages, config) {
       version: p.version,
       previousVersion: p.previousVersion,
       isNew: p.isNew
-    })),
-    config: {
-      blockThreshold: config.blockThreshold,
-      warnThreshold: config.warnThreshold
-    }
+    }))
   };
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), 18e4);
@@ -39149,7 +39146,7 @@ async function callPyPIAnalyzeAPI(packages, config, onProgress) {
     if (onProgress) onProgress(completed, packages.length);
     results.push(result);
   }
-  return mergeResponses(results, config);
+  return mergeResponses(results);
 }
 async function callPyPIBatch(packages, config) {
   const url = `${config.apiUrl}/v1/pypi/analyze`;
@@ -39159,11 +39156,7 @@ async function callPyPIBatch(packages, config) {
       version: p.version,
       previousVersion: p.previousVersion ?? null,
       isNew: p.isNew ?? true
-    })),
-    config: {
-      blockThreshold: config.blockThreshold,
-      warnThreshold: config.warnThreshold
-    }
+    }))
   };
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), 18e4);
@@ -39249,13 +39242,15 @@ function parseLockfile(content) {
       const name = extractPackageName(path);
       if (name && !packages.has(name)) {
         const e = entry;
+        const deps = e.dependencies;
         packages.set(name, {
           version: e.version ?? "",
           resolved: e.resolved,
           integrity: e.integrity,
           dev: e.dev,
           optional: e.optional,
-          hasPlatformRestriction: !!(e.os || e.cpu)
+          hasPlatformRestriction: !!(e.os || e.cpu),
+          dependencies: deps && typeof deps === "object" ? deps : void 0
         });
       }
     }
@@ -39493,8 +39488,13 @@ function discoverChanges(cwd2, config) {
   }
   const lockfileInfo = findLockfile(cwd2);
   if (!lockfileInfo) {
+    const pythonFiles = ["requirements.txt", "Pipfile.lock", "poetry.lock"];
+    const hasPython = pythonFiles.some((f) => existsSync5(join5(cwd2, f)));
+    if (hasPython) {
+      return { packages: [], method: "fallback", skipped: [] };
+    }
     throw new Error(
-      "No lockfile found (package-lock.json, yarn.lock, or pnpm-lock.yaml). Run from your project root or use --base-lockfile."
+      "No lockfile found (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, or poetry.lock). Run from your project root or use --base-lockfile."
     );
   }
   const headContent = readFileSafe(lockfileInfo.path);
@@ -39505,6 +39505,7 @@ function discoverChanges(cwd2, config) {
     for (const [name, entry] of headParsed.packages) {
       if (packages2.length >= config.maxPackages) break;
       if (entry.optional && entry.hasPlatformRestriction) continue;
+      if (name === SELF_PACKAGE) continue;
       packages2.push({
         name,
         version: entry.version,
@@ -39522,7 +39523,7 @@ function discoverChanges(cwd2, config) {
     const baseParsed = parseLockfile(baseContent2);
     const diff2 = diffLockfiles(baseParsed, headParsed, config.maxPackages, directDeps);
     return {
-      packages: diff2.changes.map(toPackageInput),
+      packages: diff2.changes.map(toPackageInput).filter((p) => p.name !== SELF_PACKAGE),
       method: "base-lockfile",
       skipped: diff2.skipped
     };
@@ -39532,7 +39533,7 @@ function discoverChanges(cwd2, config) {
     const baseParsed = parseLockfile(baseContent);
     const diff2 = diffLockfiles(baseParsed, headParsed, config.maxPackages, directDeps);
     return {
-      packages: diff2.changes.map(toPackageInput),
+      packages: diff2.changes.map(toPackageInput).filter((p) => p.name !== SELF_PACKAGE),
       method: "git-diff",
       skipped: diff2.skipped
     };
@@ -39551,7 +39552,7 @@ function discoverChanges(cwd2, config) {
         };
       });
       return {
-        packages: resolved.map(toPackageInput),
+        packages: resolved.map(toPackageInput).filter((p) => p.name !== SELF_PACKAGE),
         method: "fallback",
         skipped: []
       };
@@ -39561,6 +39562,7 @@ function discoverChanges(cwd2, config) {
   for (const [name, entry] of headParsed.packages) {
     if (packages.length >= config.maxPackages) break;
     if (entry.optional && entry.hasPlatformRestriction) continue;
+    if (name === SELF_PACKAGE) continue;
     packages.push({
       name,
       version: entry.version,
@@ -39703,7 +39705,7 @@ function parsePythonDepFile(projectDir, depFile) {
   }
   return packages;
 }
-var MAX_LOCKFILE_BYTES;
+var MAX_LOCKFILE_BYTES, SELF_PACKAGE;
 var init_lockfile = __esm({
   "src/lockfile.ts"() {
     "use strict";
@@ -39713,6 +39715,207 @@ var init_lockfile = __esm({
     init_diff2();
     init_parse_package_json();
     MAX_LOCKFILE_BYTES = 50 * 1024 * 1024;
+    SELF_PACKAGE = "@westbayberry/dg";
+  }
+});
+
+// src/pip-wrapper.ts
+import { spawn as spawn4 } from "node:child_process";
+import { readFileSync as readFileSync7, existsSync as existsSync6 } from "node:fs";
+function parsePipArgs(args) {
+  let dgForce = false;
+  const filtered = [];
+  for (const arg of args) {
+    if (arg === "--dg-force") {
+      dgForce = true;
+    } else {
+      filtered.push(arg);
+    }
+  }
+  const command = filtered[0] ?? "";
+  const shouldScan = INSTALL_COMMANDS2.has(command);
+  const packages = [];
+  let requirementsFile;
+  if (shouldScan) {
+    for (let i = 1; i < filtered.length; i++) {
+      const arg = filtered[i];
+      if (arg === "-r" || arg === "--requirement") {
+        if (i + 1 < filtered.length) {
+          requirementsFile = filtered[i + 1];
+          i++;
+        }
+        continue;
+      }
+      if (arg.startsWith("-")) {
+        if (pipFlagTakesValue(arg)) i++;
+        continue;
+      }
+      packages.push(arg);
+    }
+  }
+  return {
+    command,
+    packages,
+    rawArgs: filtered,
+    dgForce,
+    shouldScan,
+    requirementsFile
+  };
+}
+function pipFlagTakesValue(flag) {
+  const valueFlags = [
+    "--index-url",
+    "-i",
+    "--extra-index-url",
+    "--constraint",
+    "-c",
+    "--requirement",
+    "-r",
+    "--target",
+    "-t",
+    "--prefix",
+    "--src",
+    "--root",
+    "--config-settings"
+  ];
+  for (const f of valueFlags) {
+    if (flag === f) return true;
+  }
+  return false;
+}
+function parseRequirementsFile(filePath) {
+  if (!existsSync6(filePath)) return [];
+  try {
+    const content = readFileSync7(filePath, "utf-8");
+    const specs = [];
+    for (const rawLine of content.split("\n")) {
+      let line = rawLine.trim();
+      if (!line) continue;
+      if (line.startsWith("#")) continue;
+      if (line.startsWith("-e") || line.startsWith("--editable")) continue;
+      if (/^(git|svn|hg|bzr)\+/.test(line)) continue;
+      if (line.startsWith("-r") || line.startsWith("--requirement")) continue;
+      if (line.startsWith("--")) continue;
+      const commentIdx = line.indexOf(" #");
+      if (commentIdx !== -1) line = line.slice(0, commentIdx).trim();
+      const markerIdx = line.indexOf(";");
+      if (markerIdx !== -1) line = line.slice(0, markerIdx).trim();
+      if (line) specs.push(line);
+    }
+    return specs;
+  } catch {
+    return [];
+  }
+}
+function parsePipSpec(spec) {
+  const match = spec.match(/^([a-zA-Z0-9][-a-zA-Z0-9._]*)(([><=!~]=?).+)?$/);
+  if (!match) return { name: spec, versionSpec: null };
+  return {
+    name: match[1],
+    versionSpec: match[2] ?? null
+  };
+}
+async function resolvePipVersion(spec) {
+  const { name, versionSpec } = parsePipSpec(spec);
+  if (versionSpec?.startsWith("==")) {
+    const version = versionSpec.slice(2);
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 15e3);
+      const resp = await fetch(`https://pypi.org/pypi/${name}/${version}/json`, {
+        signal: controller.signal
+      });
+      clearTimeout(timer);
+      if (resp.ok) return version;
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 15e3);
+    const resp = await fetch(`https://pypi.org/pypi/${name}/json`, {
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    if (!resp.ok) return null;
+    const data = await resp.json();
+    return data.info?.version ?? null;
+  } catch {
+    return null;
+  }
+}
+async function resolvePackages2(specs) {
+  const results = await Promise.allSettled(
+    specs.map(async (spec) => {
+      const { name } = parsePipSpec(spec);
+      const version = await resolvePipVersion(spec);
+      return { spec, name, version };
+    })
+  );
+  const resolved = [];
+  const failed = [];
+  for (const result of results) {
+    if (result.status === "rejected") {
+      failed.push("unknown");
+      continue;
+    }
+    const { spec, name, version } = result.value;
+    if (version) {
+      resolved.push({
+        name,
+        version,
+        previousVersion: null,
+        isNew: true
+      });
+    } else {
+      failed.push(spec);
+    }
+  }
+  return { resolved, failed };
+}
+async function detectPipBinary() {
+  if (cachedPipBinary) return cachedPipBinary;
+  const candidates = ["python3 -m pip", "python -m pip", "pip3", "pip"];
+  for (const cmd of candidates) {
+    try {
+      const parts = cmd.split(" ");
+      const code = await new Promise((resolve) => {
+        const child = spawn4(parts[0], [...parts.slice(1), "--version"], {
+          stdio: ["pipe", "pipe", "pipe"],
+          timeout: 5e3
+        });
+        child.on("close", (c) => resolve(c ?? 1));
+        child.on("error", () => resolve(1));
+      });
+      if (code === 0) {
+        cachedPipBinary = cmd;
+        return cmd;
+      }
+    } catch {
+    }
+  }
+  throw new Error("pip not found. Install pip or ensure 'python -m pip' is available.");
+}
+async function runPip(args) {
+  const pipCmd = await detectPipBinary();
+  const parts = pipCmd.split(" ");
+  return new Promise((resolve) => {
+    const child = spawn4(parts[0], [...parts.slice(1), ...args], {
+      stdio: "inherit",
+      shell: false
+    });
+    child.on("close", (code) => resolve(code ?? 1));
+    child.on("error", () => resolve(1));
+  });
+}
+var INSTALL_COMMANDS2, cachedPipBinary;
+var init_pip_wrapper = __esm({
+  "src/pip-wrapper.ts"() {
+    "use strict";
+    INSTALL_COMMANDS2 = /* @__PURE__ */ new Set(["install", "update"]);
+    cachedPipBinary = null;
   }
 });
 
@@ -39721,7 +39924,7 @@ var discover_exports = {};
 __export(discover_exports, {
   discoverProjects: () => discoverProjects
 });
-import { existsSync as existsSync6, readFileSync as readFileSync7, readdirSync, lstatSync } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8, readdirSync, lstatSync } from "node:fs";
 import { join as join6, relative, basename } from "node:path";
 function discoverProjects(root) {
   const projects = [];
@@ -39732,7 +39935,7 @@ function walk(dir, root, depth, out) {
   if (depth > MAX_DEPTH) return;
   for (const lockfile of NPM_LOCKFILES) {
     const lockPath = join6(dir, lockfile);
-    if (existsSync6(lockPath)) {
+    if (existsSync7(lockPath)) {
       const count = countNpmPackages(lockPath);
       if (count > 0) {
         out.push({
@@ -39748,7 +39951,7 @@ function walk(dir, root, depth, out) {
   }
   for (const depFile of PYTHON_DEPFILES) {
     const depPath = join6(dir, depFile);
-    if (existsSync6(depPath)) {
+    if (existsSync7(depPath)) {
       const count = countPythonPackages(depPath, depFile);
       if (count > 0) {
         out.push({
@@ -39783,7 +39986,7 @@ function walk(dir, root, depth, out) {
 function countNpmPackages(lockPath) {
   try {
     const name = basename(lockPath);
-    const content = readFileSync7(lockPath, "utf-8");
+    const content = readFileSync8(lockPath, "utf-8");
     if (name === "yarn.lock") {
       return (content.match(/^\S.*:$/gm) || []).length;
     }
@@ -39804,7 +40007,7 @@ function countNpmPackages(lockPath) {
 }
 function countPythonPackages(depPath, depFile) {
   try {
-    const content = readFileSync7(depPath, "utf-8");
+    const content = readFileSync8(depPath, "utf-8");
     if (depFile === "Pipfile.lock") {
       const parsed = JSON.parse(content);
       const defaultCount = Object.keys(parsed.default || {}).length;
@@ -39861,40 +40064,50 @@ __export(static_output_exports, {
   renderResultStatic: () => renderResultStatic,
   runStatic: () => runStatic,
   runStaticLogin: () => runStaticLogin,
-  runStaticNpm: () => runStaticNpm
+  runStaticNpm: () => runStaticNpm,
+  runStaticPip: () => runStaticPip
 });
 function printTrialBanner(result) {
   if (result.trialScansRemaining === void 0) return;
-  const remaining = result.trialScansRemaining;
-  if (remaining > 0) {
-    process.stderr.write(
-      import_chalk4.default.dim(`  ${remaining} free scan${remaining !== 1 ? "s" : ""} remaining. `) + import_chalk4.default.dim(`Run \`dg login\` for unlimited scans.
-`)
-    );
-  } else {
-    process.stderr.write(
-      import_chalk4.default.yellow(`  No free scans remaining. `) + import_chalk4.default.yellow(`Run \`dg login\` to continue scanning.
+  process.stderr.write(
+    import_chalk4.default.dim(`  Free tier \xB7 Run \`dg login\` for finding details and higher rate limits.
 `)
-    );
-  }
+  );
 }
-function handleTrialExhausted2(error) {
+function handleTrialExhausted2(error, jsonMode = false) {
   if (error instanceof TrialExhaustedError) {
-    process.stderr.write(
-      import_chalk4.default.yellow("\n  Free trial scans used up.\n") + import_chalk4.default.white("  Run `dg login` to create a free account and continue scanning.\n\n")
-    );
+    let hasKey = false;
+    try {
+      const { getStoredApiKey: getStoredApiKey2 } = (init_auth(), __toCommonJS(auth_exports));
+      hasKey = !!getStoredApiKey2();
+    } catch {
+    }
+    const message = hasKey ? "Your API key may be invalid or expired. Run `dg logout` then `dg login` to re-authenticate." : "Free trial scans used up. Run `dg login` to create a free account and continue scanning.";
+    if (jsonMode) {
+      process.stdout.write(JSON.stringify({
+        error: true,
+        code: "trial_exhausted",
+        message,
+        scansUsed: error.scansUsed,
+        maxScans: error.maxScans
+      }, null, 2) + "\n");
+    } else {
+      if (hasKey) {
+        process.stderr.write(import_chalk4.default.yellow(`
+  ${message}
+
+`));
+      } else {
+        process.stderr.write(
+          import_chalk4.default.yellow("\n  Free trial scans used up.\n") + import_chalk4.default.white("  Run `dg login` to create a free account and continue scanning.\n\n")
+        );
+      }
+    }
     process.exit(1);
     return true;
   }
   return false;
 }
-function severityColor(sev) {
-  if (sev >= 5) return (s) => import_chalk4.default.bold.red(s);
-  if (sev >= 4) return import_chalk4.default.red;
-  if (sev >= 3) return import_chalk4.default.yellow;
-  if (sev >= 2) return import_chalk4.default.cyan;
-  return import_chalk4.default.dim;
-}
 function actionColor(action) {
   if (action === "block") return import_chalk4.default.red;
   if (action === "warn") return import_chalk4.default.yellow;
@@ -39917,9 +40130,9 @@ function groupPackages(packages) {
   }
   return [...map.values()].map((pkgs) => ({ packages: pkgs, key: pkgs[0].name })).sort((a, b) => b.packages[0].score - a.packages[0].score);
 }
-function actionBadge(score, config) {
-  if (score >= config.blockThreshold) return { label: "BLOCK", color: import_chalk4.default.red };
-  if (score >= config.warnThreshold) return { label: "WARN", color: import_chalk4.default.yellow };
+function actionBadge(score) {
+  if (score >= 70) return { label: "BLOCK", color: import_chalk4.default.red };
+  if (score >= 60) return { label: "WARN", color: import_chalk4.default.yellow };
   return { label: "pass", color: import_chalk4.default.green };
 }
 function renderResultStatic(result, config) {
@@ -39949,6 +40162,15 @@ function renderResultStatic(result, config) {
       `  ${total} package${total !== 1 ? "s" : ""} scanned ${import_chalk4.default.dim("\u2502")} ${import_chalk4.default.green("all clean")}`
     );
   }
+  const licensedPkgs = result.packages.filter((p) => p.license);
+  const licenseIssues = licensedPkgs.filter(
+    (p) => p.license && p.license.riskCategory !== "permissive"
+  );
+  if (licenseIssues.length > 0) {
+    lines.push(
+      `  ${import_chalk4.default.dim("Licenses:")} ${import_chalk4.default.yellow(`${licenseIssues.length} need review`)} \u2502 ${import_chalk4.default.green(`${licensedPkgs.length - licenseIssues.length} permissive`)}`
+    );
+  }
   lines.push("");
   if (total === 0) {
     lines.push("  No packages to scan.");
@@ -39961,10 +40183,13 @@ function renderResultStatic(result, config) {
     lines.push(`  ${import_chalk4.default.dim("\u2500".repeat(60))}`);
     for (const group of groups) {
       const rep = group.packages[0];
-      const { label, color } = actionBadge(rep.score, config);
+      const { label, color } = actionBadge(rep.score);
       const names = group.packages.length === 1 ? rep.name : group.packages.length <= 3 ? group.packages.map((p) => p.name).join(", ") : `${group.packages[0].name} + ${group.packages.length - 1} similar`;
+      const lcInfo = rep.license;
+      const lcStr = lcInfo ? truncate(lcInfo.spdx ?? lcInfo.raw ?? "", 14) : "";
+      const lcColor = !lcInfo ? import_chalk4.default.dim : lcInfo.riskCategory === "permissive" ? import_chalk4.default.green : lcInfo.riskCategory === "no-license" || lcInfo.riskCategory === "unlicensed" || lcInfo.riskCategory === "network-copyleft" ? import_chalk4.default.red : import_chalk4.default.yellow;
       lines.push(
-        `    ${color(pad(label, 7))}${import_chalk4.default.bold(pad(truncate(names, 50), 52))}${import_chalk4.default.dim(`score ${rep.score}`)}`
+        `    ${color(pad(label, 7))}${import_chalk4.default.bold(pad(truncate(names, 36), 38))}${lcColor(pad(lcStr, 16))}${import_chalk4.default.dim(`score ${rep.score}`)}`
       );
     }
     lines.push("");
@@ -39975,46 +40200,6 @@ function renderResultStatic(result, config) {
     );
     lines.push("");
   }
-  for (const group of groups) {
-    const rep = group.packages[0];
-    const names = group.packages.length === 1 ? `${rep.name}@${rep.version}` : group.packages.length <= 3 ? group.packages.map((p) => `${p.name}@${p.version}`).join(", ") : `${rep.name}@${rep.version} + ${group.packages.length - 1} identical packages`;
-    lines.push(
-      `  ${import_chalk4.default.dim("\u2500\u2500")} ${import_chalk4.default.bold(`${names} (score: ${rep.score})`)}`
-    );
-    if (group.packages.length > 3) {
-      lines.push(
-        `     ${import_chalk4.default.dim("Affects: " + group.packages.map((p) => p.name).join(", "))}`
-      );
-    }
-    lines.push("");
-    const visibleFindings = rep.findings.filter((f) => f.severity > 1 || f.critical).sort((a, b) => b.severity - a.severity);
-    for (const finding of visibleFindings) {
-      const sevLabel = SEVERITY_LABELS[finding.severity] ?? "INFO";
-      const colorFn = severityColor(finding.severity);
-      lines.push(
-        `    ${colorFn(pad(sevLabel, 10))}${finding.id} \u2014 ${finding.title}`
-      );
-      const evidenceLimit = 3;
-      for (let i = 0; i < Math.min(finding.evidence.length, evidenceLimit); i++) {
-        lines.push(
-          `    ${" ".repeat(10)}${import_chalk4.default.dim(truncate(finding.evidence[i], 76))}`
-        );
-      }
-      if (finding.evidence.length > evidenceLimit) {
-        lines.push(
-          `    ${" ".repeat(10)}${import_chalk4.default.dim(`... and ${finding.evidence.length - evidenceLimit} more`)}`
-        );
-      }
-      lines.push("");
-    }
-    const safeVersion = result.safeVersions[rep.name];
-    if (safeVersion) {
-      lines.push(
-        `    ${import_chalk4.default.green(`Safe version: ${rep.name}@${safeVersion}`)}`
-      );
-      lines.push("");
-    }
-  }
   if (result.durationMs) {
     lines.push(
       `  ${import_chalk4.default.dim(`Completed in ${(result.durationMs / 1e3).toFixed(1)}s`)}`
@@ -40036,7 +40221,7 @@ async function runStatic(config) {
     process.exit(0);
   }
   dbg(
-    `mode=${config.mode} block=${config.blockThreshold} warn=${config.warnThreshold} max=${config.maxPackages}`
+    `mode=${config.mode} max=${config.maxPackages}`
   );
   dbg(`api=${config.apiUrl}`);
   process.stderr.write(import_chalk4.default.dim("  Discovering package changes...\n"));
@@ -40063,15 +40248,7 @@ async function runStatic(config) {
     }
     process.exit(0);
   }
-  const packages = discovery.packages.filter(
-    (p) => !config.allowlist.includes(p.name.toLowerCase())
-  );
-  if (packages.length === 0) {
-    process.stderr.write(
-      import_chalk4.default.dim("  All changed packages are allowlisted.\n")
-    );
-    process.exit(0);
-  }
+  const packages = discovery.packages;
   process.stderr.write(
     import_chalk4.default.dim(
       `  Scanning ${packages.length} package${packages.length !== 1 ? "s" : ""} (${discovery.method})...
@@ -40100,7 +40277,7 @@ async function runStatic(config) {
       `API responded in ${Date.now() - startMs}ms, action=${result.action}, score=${result.score}`
     );
   } catch (error) {
-    if (handleTrialExhausted2(error)) return;
+    if (handleTrialExhausted2(error, config.json)) return;
     throw error;
   }
   const output = renderResultStatic(result, config);
@@ -40172,24 +40349,16 @@ async function runStaticNpm(npmArgs, config) {
   return scanAndInstallStatic(resolved, parsed, config);
 }
 async function scanAndInstallStatic(resolved, parsed, config) {
-  const toScan = resolved.filter((p) => !config.allowlist.includes(p.name.toLowerCase()));
-  if (toScan.length === 0) {
-    process.stderr.write(
-      import_chalk4.default.dim("  All packages are allowlisted. Passing through to npm.\n")
-    );
-    const code = await runNpm(parsed.rawArgs);
-    process.exit(code);
-  }
   process.stderr.write(
     import_chalk4.default.dim(
-      `  Scanning ${toScan.length} package${toScan.length !== 1 ? "s" : ""}...
+      `  Scanning ${resolved.length} package${resolved.length !== 1 ? "s" : ""}...
 `
     )
   );
   let result;
   try {
     const startMs = Date.now();
-    result = await callAnalyzeAPI(toScan, config);
+    result = await callAnalyzeAPI(resolved, config);
     const elapsed = Date.now() - startMs;
     if (config.debug) {
       process.stderr.write(
@@ -40200,7 +40369,7 @@ async function scanAndInstallStatic(resolved, parsed, config) {
       );
     }
   } catch (error) {
-    if (handleTrialExhausted2(error)) return;
+    if (handleTrialExhausted2(error, config.json)) return;
     const msg = error instanceof Error ? error.message : String(error);
     process.stderr.write(
       import_chalk4.default.yellow(
@@ -40215,7 +40384,7 @@ async function scanAndInstallStatic(resolved, parsed, config) {
   if (result.action === "pass") {
     process.stderr.write(
       import_chalk4.default.green(
-        `  ${import_chalk4.default.bold("\u2713")} ${toScan.length} package${toScan.length !== 1 ? "s" : ""} scanned \u2014 all clear
+        `  ${import_chalk4.default.bold("\u2713")} ${resolved.length} package${resolved.length !== 1 ? "s" : ""} scanned \u2014 all clear
 `
       )
     );
@@ -40255,6 +40424,102 @@ async function scanAndInstallStatic(resolved, parsed, config) {
     process.exit(2);
   }
 }
+async function runStaticPip(pipArgs, config) {
+  const parsed = parsePipArgs(pipArgs);
+  if (!parsed.shouldScan) {
+    const code = await runPip(parsed.rawArgs);
+    process.exit(code);
+  }
+  let specs = parsed.packages;
+  if (specs.length === 0 && parsed.requirementsFile) {
+    specs = parseRequirementsFile(parsed.requirementsFile);
+  }
+  if (specs.length === 0) {
+    process.stderr.write(
+      import_chalk4.default.dim("  Dependency Guardian: no packages to scan, passing through to pip.\n")
+    );
+    const code = await runPip(parsed.rawArgs);
+    process.exit(code);
+  }
+  process.stderr.write(
+    import_chalk4.default.dim(
+      `  Resolving ${specs.length} package${specs.length !== 1 ? "s" : ""} from PyPI...
+`
+    )
+  );
+  const { resolved, failed } = await resolvePackages2(specs);
+  if (failed.length > 0) {
+    process.stderr.write(
+      import_chalk4.default.yellow(`  Warning: Could not resolve versions for: ${failed.join(", ")}
+`)
+    );
+  }
+  if (resolved.length === 0) {
+    process.stderr.write(
+      import_chalk4.default.dim("  No packages to scan. Passing through to pip.\n")
+    );
+    const code = await runPip(parsed.rawArgs);
+    process.exit(code);
+  }
+  process.stderr.write(
+    import_chalk4.default.dim(
+      `  Scanning ${resolved.length} Python package${resolved.length !== 1 ? "s" : ""}...
+`
+    )
+  );
+  let result;
+  try {
+    result = await callPyPIAnalyzeAPI(resolved, config);
+  } catch (error) {
+    if (handleTrialExhausted2(error, config.json)) return;
+    const msg = error instanceof Error ? error.message : String(error);
+    process.stderr.write(
+      import_chalk4.default.yellow(`  Warning: Scan failed (${msg}). Proceeding with install.
+`)
+    );
+    const code = await runPip(parsed.rawArgs);
+    process.exit(code);
+    return;
+  }
+  if (result.action === "pass") {
+    process.stderr.write(
+      import_chalk4.default.green(
+        `  ${import_chalk4.default.bold("\u2713")} ${resolved.length} package${resolved.length !== 1 ? "s" : ""} scanned \u2014 all clear
+`
+      )
+    );
+    printTrialBanner(result);
+    process.stderr.write("\n");
+    const code = await runPip(parsed.rawArgs);
+    process.exit(code);
+  }
+  const output = renderResultStatic(result, config);
+  process.stdout.write(output + "\n");
+  printTrialBanner(result);
+  if (result.action === "warn") {
+    process.stderr.write(
+      import_chalk4.default.yellow("  Warnings detected. Proceeding with install.\n\n")
+    );
+    const code = await runPip(parsed.rawArgs);
+    process.exit(code);
+  }
+  if (result.action === "block") {
+    if (parsed.dgForce) {
+      process.stderr.write(
+        import_chalk4.default.yellow(import_chalk4.default.bold("  --dg-force: Bypassing block. Install at your own risk.\n\n"))
+      );
+      const code = await runPip(parsed.rawArgs);
+      process.exit(code);
+    }
+    process.stderr.write(
+      import_chalk4.default.red(import_chalk4.default.bold("  BLOCKED: ")) + import_chalk4.default.red("High-risk packages detected. Install aborted.\n")
+    );
+    process.stderr.write(
+      import_chalk4.default.dim("  Use --dg-force to bypass this check.\n\n")
+    );
+    process.exit(2);
+  }
+}
 async function runStaticLogin() {
   const {
     createAuthSession: createAuthSession2,
@@ -40332,7 +40597,7 @@ async function runStaticLogin() {
   );
   process.exit(1);
 }
-var import_chalk4, SEVERITY_LABELS;
+var import_chalk4;
 var init_static_output = __esm({
   "src/static-output.ts"() {
     "use strict";
@@ -40340,13 +40605,7 @@ var init_static_output = __esm({
     init_api();
     init_lockfile();
     init_npm_wrapper();
-    SEVERITY_LABELS = {
-      5: "CRITICAL",
-      4: "HIGH",
-      3: "MEDIUM",
-      2: "LOW",
-      1: "INFO"
-    };
+    init_pip_wrapper();
   }
 });
 
@@ -40357,8 +40616,8 @@ __export(hook_exports, {
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
 import {
-  existsSync as existsSync7,
-  readFileSync as readFileSync8,
+  existsSync as existsSync8,
+  readFileSync as readFileSync9,
   writeFileSync as writeFileSync3,
   mkdirSync,
   chmodSync as chmodSync2,
@@ -40380,8 +40639,8 @@ function installHook() {
   const hooksDir = join7(gitDir, "hooks");
   const hookPath = join7(hooksDir, "pre-commit");
   mkdirSync(hooksDir, { recursive: true });
-  if (existsSync7(hookPath)) {
-    const existing = readFileSync8(hookPath, "utf-8");
+  if (existsSync8(hookPath)) {
+    const existing = readFileSync9(hookPath, "utf-8");
     if (existing.includes(HOOK_MARKER)) {
       process.stderr.write("  Hook already installed.\n");
       return;
@@ -40402,11 +40661,11 @@ function installHook() {
 function uninstallHook() {
   const gitDir = findGitDir();
   const hookPath = join7(gitDir, "hooks", "pre-commit");
-  if (!existsSync7(hookPath)) {
+  if (!existsSync8(hookPath)) {
     process.stderr.write("  No hook to remove.\n");
     return;
   }
-  const content = readFileSync8(hookPath, "utf-8");
+  const content = readFileSync9(hookPath, "utf-8");
   if (!content.includes(HOOK_MARKER)) {
     process.stderr.write(
       "  No Dependency Guardian hook found in pre-commit.\n"
@@ -40601,19 +40860,10 @@ function useNpmWrapper(npmArgs, config) {
           dispatch({ type: "DONE", exitCode: code });
           return;
         }
-        const toScan = resolved.filter(
-          (p) => !config.allowlist.includes(p.name.toLowerCase())
-        );
-        if (toScan.length === 0) {
-          dispatch({ type: "INSTALLING" });
-          const code = await runNpm(parsed.rawArgs);
-          dispatch({ type: "DONE", exitCode: code });
-          return;
-        }
-        dispatch({ type: "SCANNING", count: toScan.length });
-        const result = await callAnalyzeAPI(toScan, config);
+        dispatch({ type: "SCANNING", count: resolved.length });
+        const result = await callAnalyzeAPI(resolved, config);
         if (result.action === "pass") {
-          dispatch({ type: "PASS", count: toScan.length });
+          dispatch({ type: "PASS", count: resolved.length });
           dispatch({ type: "INSTALLING" });
           const code = await runNpm(parsed.rawArgs);
           dispatch({ type: "DONE", exitCode: code });
@@ -40886,16 +41136,16 @@ function groupPackages2(packages) {
   }
   return [...map.values()].map((pkgs) => ({ packages: pkgs, key: pkgs[0].name })).sort((a, b) => b.packages[0].score - a.packages[0].score);
 }
-function severityColor2(sev) {
+function severityColor(sev) {
   if (sev >= 5) return (s) => import_chalk6.default.bold.red(s);
   if (sev >= 4) return import_chalk6.default.magenta;
   if (sev >= 3) return import_chalk6.default.yellow;
   if (sev >= 2) return import_chalk6.default.dim;
   return import_chalk6.default.dim;
 }
-function actionBadge2(score, config) {
-  if (score >= config.blockThreshold) return { label: "BLOCK", color: import_chalk6.default.red };
-  if (score >= config.warnThreshold) return { label: "WARN", color: import_chalk6.default.yellow };
+function actionBadge2(score) {
+  if (score >= 70) return { label: "BLOCK", color: import_chalk6.default.red };
+  if (score >= 60) return { label: "WARN", color: import_chalk6.default.yellow };
   return { label: "PASS", color: import_chalk6.default.green };
 }
 function truncate2(s, max) {
@@ -40904,7 +41154,7 @@ function truncate2(s, max) {
 function pad2(s, len) {
   return s + " ".repeat(Math.max(0, len - s.length));
 }
-var import_chalk6, import_jsx_runtime5, SEVERITY_LABELS2, EVIDENCE_LIMIT, ResultsView;
+var import_chalk6, import_jsx_runtime5, SEVERITY_LABELS, EVIDENCE_LIMIT, ResultsView;
 var init_ResultsView = __esm({
   async "src/ui/components/ResultsView.tsx"() {
     "use strict";
@@ -40913,7 +41163,7 @@ var init_ResultsView = __esm({
     await init_ScoreHeader();
     await init_DurationLine();
     import_jsx_runtime5 = __toESM(require_jsx_runtime());
-    SEVERITY_LABELS2 = {
+    SEVERITY_LABELS = {
       5: "CRITICAL",
       4: "HIGH",
       3: "MEDIUM",
@@ -40952,7 +41202,7 @@ var init_ResultsView = __esm({
           /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(Text, { dimColor: true, children: "\u2500".repeat(60) }),
           groups.map((group) => {
             const rep = group.packages[0];
-            const { label, color } = actionBadge2(rep.score, config);
+            const { label, color } = actionBadge2(rep.score);
             const names = group.packages.length === 1 ? rep.name : group.packages.length <= 3 ? group.packages.map((p) => p.name).join(", ") : `${group.packages[0].name} + ${group.packages.length - 1} similar`;
             return /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(Text, { children: [
               "  ",
@@ -40988,8 +41238,8 @@ var init_ResultsView = __esm({
             ] }),
             /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(Text, { children: " " }),
             visibleFindings.map((finding, idx) => {
-              const sevLabel = SEVERITY_LABELS2[finding.severity] ?? "INFO";
-              const colorFn = severityColor2(finding.severity);
+              const sevLabel = SEVERITY_LABELS[finding.severity] ?? "INFO";
+              const colorFn = severityColor(finding.severity);
               const evidenceSlice = finding.evidence.slice(0, EVIDENCE_LIMIT);
               const overflow = finding.evidence.length - EVIDENCE_LIMIT;
               return /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(Box_default, { flexDirection: "column", children: [
@@ -41247,22 +41497,349 @@ var init_NpmWrapperApp = __esm({
           return /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(ErrorView, { error: new Error(state.message) });
         case "passthrough":
           return null;
-        case "trial_exhausted":
-          return /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(Box_default, { flexDirection: "column", paddingLeft: 2, children: [
+        case "trial_exhausted": {
+          let hasKey = false;
+          try {
+            const { getStoredApiKey: getStoredApiKey2 } = (init_auth(), __toCommonJS(auth_exports));
+            hasKey = !!getStoredApiKey2();
+          } catch {
+          }
+          return /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(Box_default, { flexDirection: "column", paddingLeft: 2, children: hasKey ? /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(import_jsx_runtime8.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(Text, { color: "yellow", bold: true, children: "Your API key may be invalid or expired." }),
+            /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(Text, { children: [
+              "Run ",
+              /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(Text, { color: "cyan", bold: true, children: "dg logout" }),
+              " then ",
+              /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(Text, { color: "cyan", bold: true, children: "dg login" }),
+              " to re-authenticate."
+            ] })
+          ] }) : /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(import_jsx_runtime8.Fragment, { children: [
             /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(Text, { color: "yellow", bold: true, children: "Free trial scans used up." }),
             /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(Text, { children: [
               "Run ",
               /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(Text, { color: "cyan", bold: true, children: "dg login" }),
               " to create a free account and continue scanning."
             ] })
+          ] }) });
+        }
+      }
+    };
+  }
+});
+
+// src/ui/hooks/usePipWrapper.ts
+function reducer3(_state, action) {
+  switch (action.type) {
+    case "PASSTHROUGH":
+      return { phase: "passthrough" };
+    case "RESOLVING":
+      return { phase: "resolving", count: action.count };
+    case "SCANNING":
+      return { phase: "scanning", count: action.count };
+    case "PASS":
+      return { phase: "pass", count: action.count };
+    case "WARN":
+      return { phase: "warn", result: action.result };
+    case "BLOCKED":
+      return { phase: "blocked", result: action.result, dgForce: action.dgForce };
+    case "INSTALLING":
+      return { phase: "installing" };
+    case "DONE":
+      return { phase: "done", exitCode: action.exitCode };
+    case "ERROR":
+      return { phase: "error", message: action.message, proceed: action.proceed };
+    case "TRIAL_EXHAUSTED":
+      return { phase: "trial_exhausted" };
+  }
+}
+function usePipWrapper(pipArgs, config) {
+  const [state, dispatch] = (0, import_react27.useReducer)(reducer3, { phase: "resolving", count: 0 });
+  const started = (0, import_react27.useRef)(false);
+  const parsedRef = (0, import_react27.useRef)(parsePipArgs(pipArgs));
+  const pendingInstall = (0, import_react27.useRef)(null);
+  const rejectRef = (0, import_react27.useRef)(null);
+  const confirmInstall = () => {
+    if (pendingInstall.current) {
+      pendingInstall.current();
+      pendingInstall.current = null;
+      rejectRef.current = null;
+    }
+  };
+  const rejectInstall = () => {
+    if (rejectRef.current) {
+      rejectRef.current();
+      pendingInstall.current = null;
+      rejectRef.current = null;
+    }
+  };
+  (0, import_react27.useEffect)(() => {
+    if (started.current) return;
+    started.current = true;
+    const parsed = parsedRef.current;
+    (async () => {
+      try {
+        if (!parsed.shouldScan) {
+          dispatch({ type: "PASSTHROUGH" });
+          const code = await runPip(parsed.rawArgs);
+          dispatch({ type: "DONE", exitCode: code });
+          return;
+        }
+        let specs;
+        if (parsed.packages.length === 0 && parsed.requirementsFile) {
+          specs = parseRequirementsFile(parsed.requirementsFile);
+          if (specs.length === 0) {
+            dispatch({ type: "PASSTHROUGH" });
+            const code = await runPip(parsed.rawArgs);
+            dispatch({ type: "DONE", exitCode: code });
+            return;
+          }
+        } else if (parsed.packages.length === 0) {
+          dispatch({ type: "PASSTHROUGH" });
+          const code = await runPip(parsed.rawArgs);
+          dispatch({ type: "DONE", exitCode: code });
+          return;
+        } else {
+          specs = parsed.packages;
+        }
+        dispatch({ type: "RESOLVING", count: specs.length });
+        const { resolved, failed } = await resolvePackages2(specs);
+        if (resolved.length === 0) {
+          dispatch({ type: "PASSTHROUGH" });
+          const code = await runPip(parsed.rawArgs);
+          dispatch({ type: "DONE", exitCode: code });
+          return;
+        }
+        dispatch({ type: "SCANNING", count: resolved.length });
+        const result = await callPyPIAnalyzeAPI(resolved, config);
+        if (result.action === "pass") {
+          dispatch({ type: "PASS", count: resolved.length });
+          dispatch({ type: "INSTALLING" });
+          const code = await runPip(parsed.rawArgs);
+          dispatch({ type: "DONE", exitCode: code });
+          return;
+        }
+        if (result.action === "warn") {
+          dispatch({ type: "WARN", result });
+          process.stdout.write(renderResultStatic(result, config) + "\n");
+          dispatch({ type: "INSTALLING" });
+          const code = await runPip(parsed.rawArgs);
+          dispatch({ type: "DONE", exitCode: code });
+          return;
+        }
+        if (result.action === "block") {
+          process.stdout.write(renderResultStatic(result, config) + "\n");
+          if (parsed.dgForce) {
+            dispatch({ type: "BLOCKED", result, dgForce: true });
+            dispatch({ type: "INSTALLING" });
+            const code = await runPip(parsed.rawArgs);
+            dispatch({ type: "DONE", exitCode: code });
+            return;
+          }
+          dispatch({ type: "BLOCKED", result, dgForce: false });
+          const shouldProceed = await new Promise((resolve) => {
+            pendingInstall.current = () => resolve(true);
+            rejectRef.current = () => resolve(false);
+          });
+          if (shouldProceed) {
+            dispatch({ type: "INSTALLING" });
+            const code = await runPip(parsed.rawArgs);
+            dispatch({ type: "DONE", exitCode: code });
+          } else {
+            dispatch({ type: "DONE", exitCode: 2 });
+          }
+          return;
+        }
+      } catch (error) {
+        if (error instanceof TrialExhaustedError) {
+          dispatch({ type: "TRIAL_EXHAUSTED" });
+          return;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        dispatch({ type: "ERROR", message, proceed: true });
+        dispatch({ type: "INSTALLING" });
+        const code = await runPip(parsedRef.current.rawArgs);
+        dispatch({ type: "DONE", exitCode: code });
+      }
+    })();
+  }, [pipArgs, config]);
+  return { state, confirmInstall, rejectInstall };
+}
+var import_react27;
+var init_usePipWrapper = __esm({
+  "src/ui/hooks/usePipWrapper.ts"() {
+    "use strict";
+    import_react27 = __toESM(require_react());
+    init_pip_wrapper();
+    init_api();
+    init_static_output();
+  }
+});
+
+// src/ui/PipWrapperApp.tsx
+var PipWrapperApp_exports = {};
+__export(PipWrapperApp_exports, {
+  PipWrapperApp: () => PipWrapperApp
+});
+var import_react28, import_jsx_runtime9, PipWrapperApp;
+var init_PipWrapperApp = __esm({
+  async "src/ui/PipWrapperApp.tsx"() {
+    "use strict";
+    import_react28 = __toESM(require_react());
+    await init_build2();
+    init_usePipWrapper();
+    await init_Spinner();
+    await init_ResultsView();
+    await init_ConfirmPrompt();
+    await init_ErrorView();
+    import_jsx_runtime9 = __toESM(require_jsx_runtime());
+    PipWrapperApp = ({
+      pipArgs,
+      config
+    }) => {
+      const { state, confirmInstall, rejectInstall } = usePipWrapper(pipArgs, config);
+      const { exit } = use_app_default();
+      (0, import_react28.useEffect)(() => {
+        if (state.phase === "done") {
+          process.exitCode = state.exitCode;
+          const timer = setTimeout(() => exit(), 0);
+          return () => clearTimeout(timer);
+        }
+        if (state.phase === "trial_exhausted") {
+          process.exitCode = 1;
+          const timer = setTimeout(() => exit(), 0);
+          return () => clearTimeout(timer);
+        }
+        if (state.phase === "passthrough") {
+        }
+      }, [state, exit]);
+      const handleConfirm = (0, import_react28.useCallback)(() => {
+        confirmInstall();
+      }, [confirmInstall]);
+      const handleReject = (0, import_react28.useCallback)(() => {
+        rejectInstall();
+      }, [rejectInstall]);
+      switch (state.phase) {
+        case "resolving":
+          return /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            Spinner2,
+            {
+              label: `Resolving ${state.count} package${state.count !== 1 ? "s" : ""} from PyPI...`
+            }
+          );
+        case "scanning":
+          return /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+            Spinner2,
+            {
+              label: `Scanning ${state.count} Python package${state.count !== 1 ? "s" : ""}...`
+            }
+          );
+        case "pass":
+          return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Text, { color: "green", children: [
+            "\u2713",
+            " ",
+            state.count,
+            " package",
+            state.count !== 1 ? "s" : "",
+            " scanned",
+            " \u2014 ",
+            "all clear"
+          ] });
+        case "warn":
+          return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Box_default, { flexDirection: "column", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+              ResultsView,
+              {
+                result: state.result,
+                config,
+                durationMs: state.result.durationMs
+              }
+            ),
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { color: "yellow", children: "Warnings detected. Proceeding with install..." })
+          ] });
+        case "blocked":
+          if (state.dgForce) {
+            return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Box_default, { flexDirection: "column", children: [
+              /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+                ResultsView,
+                {
+                  result: state.result,
+                  config,
+                  durationMs: state.result.durationMs
+                }
+              ),
+              /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { color: "yellow", bold: true, children: "--dg-force: Bypassing block. Install at your own risk." })
+            ] });
+          }
+          return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Box_default, { flexDirection: "column", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+              ResultsView,
+              {
+                result: state.result,
+                config,
+                durationMs: state.result.durationMs
+              }
+            ),
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Text, { color: "red", bold: true, children: [
+              "BLOCKED:",
+              " ",
+              /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { color: "red", children: "High-risk packages detected." })
+            ] }),
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+              ConfirmPrompt,
+              {
+                message: "Proceed with install anyway?",
+                onConfirm: handleConfirm,
+                onReject: handleReject
+              }
+            )
           ] });
+        case "installing":
+          return /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Spinner2, { label: "Installing with pip..." });
+        case "done":
+          return null;
+        case "error":
+          if (state.proceed) {
+            return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Text, { color: "yellow", children: [
+              "Warning: Scan failed (",
+              state.message,
+              "). Proceeding with install."
+            ] });
+          }
+          return /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(ErrorView, { error: new Error(state.message) });
+        case "passthrough":
+          return null;
+        case "trial_exhausted": {
+          let hasKey = false;
+          try {
+            const { getStoredApiKey: getStoredApiKey2 } = (init_auth(), __toCommonJS(auth_exports));
+            hasKey = !!getStoredApiKey2();
+          } catch {
+          }
+          return /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Box_default, { flexDirection: "column", paddingLeft: 2, children: hasKey ? /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_jsx_runtime9.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { color: "yellow", bold: true, children: "Your API key may be invalid or expired." }),
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Text, { children: [
+              "Run ",
+              /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { color: "cyan", bold: true, children: "dg logout" }),
+              " then ",
+              /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { color: "cyan", bold: true, children: "dg login" }),
+              " to re-authenticate."
+            ] })
+          ] }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_jsx_runtime9.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { color: "yellow", bold: true, children: "Free trial scans used up." }),
+            /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Text, { children: [
+              "Run ",
+              /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { color: "cyan", bold: true, children: "dg login" }),
+              " to create a free account and continue scanning."
+            ] })
+          ] }) });
+        }
       }
     };
   }
 });
 
 // src/ui/hooks/useScan.ts
-function reducer3(_state, action) {
+function reducer4(_state, action) {
   switch (action.type) {
     case "PROJECTS_FOUND":
       return { phase: "selecting", projects: action.projects };
@@ -41283,10 +41860,10 @@ function reducer3(_state, action) {
   }
 }
 function useScan(config) {
-  const [state, dispatch] = (0, import_react27.useReducer)(reducer3, { phase: "discovering" });
-  const started = (0, import_react27.useRef)(false);
-  const [multiProjects, setMultiProjects] = (0, import_react27.useState)(null);
-  (0, import_react27.useEffect)(() => {
+  const [state, dispatch] = (0, import_react29.useReducer)(reducer4, { phase: "discovering" });
+  const started = (0, import_react29.useRef)(false);
+  const [multiProjects, setMultiProjects] = (0, import_react29.useState)(null);
+  (0, import_react29.useEffect)(() => {
     if (started.current) return;
     started.current = true;
     const projects = discoverProjects(process.cwd());
@@ -41297,10 +41874,9 @@ function useScan(config) {
     }
     try {
       const discovery = discoverChanges(process.cwd(), config);
-      const packages = discovery.packages.filter((p) => !config.allowlist.includes(p.name.toLowerCase()));
+      const packages = discovery.packages;
       if (packages.length === 0) {
-        const message = discovery.packages.length === 0 ? "No package changes detected." : "All changed packages are allowlisted.";
-        dispatch({ type: "DISCOVERY_EMPTY", message });
+        dispatch({ type: "DISCOVERY_EMPTY", message: "No package changes detected." });
         return;
       }
       dispatch({ type: "DISCOVERY_COMPLETE", packages, skippedCount: discovery.skipped.length });
@@ -41314,11 +41890,11 @@ function useScan(config) {
       scanProjects(projects, config, dispatch);
     }
   }, [config]);
-  const scanSelectedProjects = (0, import_react27.useCallback)((projects) => {
+  const scanSelectedProjects = (0, import_react29.useCallback)((projects) => {
     dispatch({ type: "DISCOVERY_COMPLETE", packages: [], skippedCount: 0 });
     scanProjects(projects, config, dispatch);
   }, [config]);
-  const restartSelection = (0, import_react27.useCallback)(() => {
+  const restartSelection = (0, import_react29.useCallback)(() => {
     if (!multiProjects) return;
     dispatch({ type: "RESTART_SELECTION", projects: multiProjects });
   }, [multiProjects]);
@@ -41359,7 +41935,7 @@ async function scanProjects(projects, config, dispatch) {
         const discovery = discoverChanges(proj.path, fullScanConfig);
         for (const pkg of discovery.packages) {
           const key = `${pkg.name}@${pkg.version}`;
-          if (!config.allowlist.includes(pkg.name.toLowerCase()) && !seenNpm.has(key)) {
+          if (!seenNpm.has(key)) {
             seenNpm.add(key);
             npmPackages.push(pkg);
           }
@@ -41372,7 +41948,7 @@ async function scanProjects(projects, config, dispatch) {
         const packages = parsePythonDepFile(proj.path, proj.depFile);
         for (const pkg of packages) {
           const key = `${pkg.name}@${pkg.version}`;
-          if (!config.allowlist.includes(pkg.name.toLowerCase()) && !seenPypi.has(key)) {
+          if (!seenPypi.has(key)) {
             seenPypi.add(key);
             pypiPackages.push(pkg);
           }
@@ -41421,7 +41997,7 @@ async function scanProjects(projects, config, dispatch) {
     }
     const allPackages = results.flatMap((r) => r.packages);
     const maxScore = Math.max(0, ...allPackages.map((p) => p.score));
-    const action = maxScore >= config.blockThreshold ? "block" : maxScore >= config.warnThreshold ? "warn" : "pass";
+    const action = maxScore >= 70 ? "block" : maxScore >= 60 ? "warn" : "pass";
     const safeVersions = {};
     for (const r of results) Object.assign(safeVersions, r.safeVersions);
     const merged = {
@@ -41440,11 +42016,11 @@ async function scanProjects(projects, config, dispatch) {
     dispatch({ type: "ERROR", error: error instanceof Error ? error : new Error(String(error)) });
   }
 }
-var import_react27;
+var import_react29;
 var init_useScan = __esm({
   "src/ui/hooks/useScan.ts"() {
     "use strict";
-    import_react27 = __toESM(require_react());
+    import_react29 = __toESM(require_react());
     init_lockfile();
     init_api();
     init_discover();
@@ -41454,7 +42030,7 @@ var init_useScan = __esm({
 
 // src/ui/components/ProgressBar.tsx
 function estimateScanSeconds(packageCount) {
-  return Math.ceil(8 + packageCount * 0.12);
+  return Math.ceil(Math.max(5, packageCount * 0.35 - 10));
 }
 function formatTime(seconds) {
   if (seconds < 60) return `${seconds}s`;
@@ -41462,23 +42038,23 @@ function formatTime(seconds) {
   const s = seconds % 60;
   return s > 0 ? `${m}m ${s}s` : `${m}m`;
 }
-var import_react28, import_chalk9, import_jsx_runtime9, ProgressBar;
+var import_react30, import_chalk9, import_jsx_runtime10, ProgressBar;
 var init_ProgressBar = __esm({
   async "src/ui/components/ProgressBar.tsx"() {
     "use strict";
-    import_react28 = __toESM(require_react());
+    import_react30 = __toESM(require_react());
     await init_build2();
     await init_build3();
     import_chalk9 = __toESM(require_source());
-    import_jsx_runtime9 = __toESM(require_jsx_runtime());
+    import_jsx_runtime10 = __toESM(require_jsx_runtime());
     ProgressBar = ({
       value,
       total,
       label
     }) => {
-      const startRef = (0, import_react28.useRef)(Date.now());
-      const [elapsed, setElapsed] = (0, import_react28.useState)(0);
-      (0, import_react28.useEffect)(() => {
+      const startRef = (0, import_react30.useRef)(Date.now());
+      const [elapsed, setElapsed] = (0, import_react30.useState)(0);
+      (0, import_react30.useEffect)(() => {
         const timer = setInterval(() => {
           setElapsed(Math.floor((Date.now() - startRef.current) / 1e3));
         }, 1e3);
@@ -41495,32 +42071,32 @@ var init_ProgressBar = __esm({
       const empty = barWidth - filled;
       const filledBar = "\u2501".repeat(filled);
       const emptyBar = "\u2501".repeat(empty);
-      return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Box_default, { flexDirection: "column", paddingLeft: 2, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Text, { children: [
+      return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: "column", paddingLeft: 2, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
           import_chalk9.default.cyan("\u25C6"),
           " ",
           import_chalk9.default.bold("Dependency Guardian")
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { children: "" }),
-        /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Box_default, { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { color: "cyan", children: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(build_default, { type: "dots" }) }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Text, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }),
+        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { color: "cyan", children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(build_default, { type: "dots" }) }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
             " Scanning ",
             total,
             " packages...  "
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { dimColor: true, children: timeInfo })
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: timeInfo })
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Box_default, { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { children: "  " }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { color: "green", children: filledBar }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { dimColor: true, children: emptyBar }),
-          /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Text, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "  " }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { color: "green", children: filledBar }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: emptyBar }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
             "  ",
             counter
           ] })
         ] }),
-        label && /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Box_default, { children: /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Text, { dimColor: true, children: [
+        label && /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
           "  ",
           import_chalk9.default.dim("\u203A"),
           " ",
@@ -41533,9 +42109,9 @@ var init_ProgressBar = __esm({
 
 // src/ui/hooks/useExpandAnimation.ts
 function useExpandAnimation(targetHeight, active, durationMs = 180) {
-  const [visibleLines, setVisibleLines] = (0, import_react29.useState)(0);
-  const timerRef = (0, import_react29.useRef)(null);
-  (0, import_react29.useEffect)(() => {
+  const [visibleLines, setVisibleLines] = (0, import_react31.useState)(0);
+  const timerRef = (0, import_react31.useRef)(null);
+  (0, import_react31.useEffect)(() => {
     if (timerRef.current) {
       clearInterval(timerRef.current);
       timerRef.current = null;
@@ -41569,22 +42145,22 @@ function useExpandAnimation(targetHeight, active, durationMs = 180) {
     isAnimating: active && visibleLines > 0 && visibleLines < targetHeight
   };
 }
-var import_react29;
+var import_react31;
 var init_useExpandAnimation = __esm({
   "src/ui/hooks/useExpandAnimation.ts"() {
     "use strict";
-    import_react29 = __toESM(require_react());
+    import_react31 = __toESM(require_react());
   }
 });
 
 // src/ui/hooks/useTerminalSize.ts
 function useTerminalSize() {
   const { stdout } = use_stdout_default();
-  const [size, setSize] = (0, import_react30.useState)({
+  const [size, setSize] = (0, import_react32.useState)({
     rows: stdout?.rows ?? process.stdout.rows ?? 24,
     cols: stdout?.columns ?? process.stdout.columns ?? 80
   });
-  (0, import_react30.useEffect)(() => {
+  (0, import_react32.useEffect)(() => {
     const handle = () => {
       const rows = process.stdout.rows ?? 24;
       const cols = process.stdout.columns ?? 80;
@@ -41602,11 +42178,11 @@ function useTerminalSize() {
   }, []);
   return size;
 }
-var import_react30;
+var import_react32;
 var init_useTerminalSize = __esm({
   async "src/ui/hooks/useTerminalSize.ts"() {
     "use strict";
-    import_react30 = __toESM(require_react());
+    import_react32 = __toESM(require_react());
     await init_build2();
   }
 });
@@ -41622,10 +42198,10 @@ function groupPackages3(packages) {
   }
   return [...map.entries()].map(([fingerprint, pkgs]) => ({ packages: pkgs, key: fingerprint })).sort((a, b) => b.packages[0].score - a.packages[0].score);
 }
-function actionBadge3(score, config) {
-  if (score >= config.blockThreshold)
+function actionBadge3(score) {
+  if (score >= 70)
     return { label: "BLOCK", color: import_chalk10.default.red };
-  if (score >= config.warnThreshold)
+  if (score >= 60)
     return { label: "WARN", color: import_chalk10.default.yellow };
   return { label: "PASS", color: import_chalk10.default.green };
 }
@@ -41639,6 +42215,7 @@ function findingsSummaryHeight(group) {
   const rep = group.packages[0];
   const visibleFindings = rep.findings.filter((f) => f.severity > 1 || f.critical);
   let h = visibleFindings.length;
+  if (rep.license) h += 1;
   if (visibleFindings.length === 0 && rep.score > 0) {
     h += (rep.reasons ?? []).length;
     h += 1;
@@ -41650,6 +42227,7 @@ function findingsDetailHeight(group, safeVersions) {
   const rep = group.packages[0];
   const visibleFindings = rep.findings.filter((f) => f.severity > 1 || f.critical).sort((a, b) => b.severity - a.severity);
   let h = 0;
+  if (rep.license) h += 1;
   if (group.packages.length > 3) h += 1;
   if (visibleFindings.length === 0 && rep.score > 0) {
     h += (rep.reasons ?? []).length;
@@ -41691,88 +42269,26 @@ function buildDetailLines(group, safeVersion, maxWidth) {
   const evidenceWidth = Math.max(30, maxWidth - 12);
   if (group.packages.length > 3) {
     lines.push(
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
         "Affects: ",
         affectsLine(group)
       ] }, "affects")
     );
-    lines.push(/* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }, "affects-gap"));
+    lines.push(/* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: "" }, "affects-gap"));
   }
-  if (visibleFindings.length === 0 && rep.score > 0) {
-    const reasons = rep.reasons ?? [];
-    for (let i = 0; i < reasons.length; i++) {
-      lines.push(
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: truncate3(reasons[i], maxWidth - 4) }, `reason-${i}`)
-      );
-    }
+  if (rep.score > 0) {
     lines.push(
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
-        import_chalk10.default.yellow("\u2192"),
-        " ",
-        import_chalk10.default.yellow("Upgrade to Pro"),
-        " ",
-        import_chalk10.default.dim("to see finding details \u2014 dg login")
-      ] }, "upgrade")
-    );
-    return lines;
-  }
-  const hasEvidence = visibleFindings.some((f) => f.evidence && f.evidence.length > 0);
-  for (let idx = 0; idx < visibleFindings.length; idx++) {
-    const finding = visibleFindings[idx];
-    const sevLabel = SEVERITY_LABELS3[finding.severity] ?? "INFO";
-    const sevColor = SEVERITY_COLORS[finding.severity] ?? SEVERITY_COLORS[1];
-    const evidence = finding.evidence ?? [];
-    const findingId = finding.id ?? finding.category ?? "";
-    if (idx > 0) lines.push(/* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }, `gap-${idx}`));
-    lines.push(
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
-        sevColor(pad3(sevLabel, 5)),
-        " ",
-        findingId
-      ] }, `${findingId}-${idx}-badge`)
-    );
-    lines.push(
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
-        "      ",
-        finding.title
-      ] }, `${findingId}-${idx}-title`)
-    );
-    const evidenceCap = Math.min(evidence.length, DETAIL_EVIDENCE_LIMIT);
-    for (let i = 0; i < evidenceCap; i++) {
-      lines.push(
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
-          "      ",
-          import_chalk10.default.dim("\u203A"),
-          " ",
-          truncate3(evidence[i], evidenceWidth)
-        ] }, `${findingId}-${idx}-ev-${i}`)
-      );
-    }
-    if (evidence.length > DETAIL_EVIDENCE_LIMIT) {
-      lines.push(
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
-          "      ",
-          import_chalk10.default.dim(`+${evidence.length - DETAIL_EVIDENCE_LIMIT} more`)
-        ] }, `${findingId}-${idx}-overflow`)
-      );
-    }
-  }
-  if (visibleFindings.length > 0 && !hasEvidence) {
-    lines.push(/* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }, "upgrade-gap"));
-    lines.push(
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
-        import_chalk10.default.yellow("\u2192"),
-        " ",
-        import_chalk10.default.yellow("Upgrade to Team"),
-        " ",
-        import_chalk10.default.dim("for evidence and file locations")
-      ] }, "upgrade-evidence")
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
+        "Score: ",
+        rep.score,
+        "/100"
+      ] }, "score-info")
     );
   }
   if (rep.recommendation) {
-    lines.push(/* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }, "rec-gap"));
+    lines.push(/* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: "" }, "rec-gap"));
     lines.push(
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
         import_chalk10.default.dim("Rec:"),
         " ",
         import_chalk10.default.cyan(truncate3(rep.recommendation, maxWidth - 8))
@@ -41781,7 +42297,7 @@ function buildDetailLines(group, safeVersion, maxWidth) {
   }
   if (safeVersion) {
     lines.push(
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: import_chalk10.default.green(`Safe: ${rep.name}@${safeVersion}`) }, "safe")
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: import_chalk10.default.green(`Safe: ${rep.name}@${safeVersion}`) }, "safe")
     );
   }
   return lines;
@@ -41796,18 +42312,34 @@ function viewReducer(_state, action) {
       return { cursor: action.cursor, expandedIndex: action.expandedIndex, expandLevel: action.expandLevel, viewport: action.viewport };
   }
 }
-var import_react31, import_chalk10, import_jsx_runtime10, SEVERITY_LABELS3, SEVERITY_COLORS, EVIDENCE_LIMIT2, FIXED_CHROME, DETAIL_PANE_CHROME, DETAIL_EVIDENCE_LIMIT, InteractiveResultsView, T, FindingsSummary;
+function licenseLine(rep) {
+  const lc = rep.license;
+  if (!lc) return null;
+  const spdx = lc.spdx ?? lc.raw ?? "";
+  const desc = LICENSE_DESCRIPTIONS[lc.riskCategory] ?? "";
+  const lcColor = lc.riskCategory === "permissive" ? import_chalk10.default.green : lc.riskCategory === "no-license" || lc.riskCategory === "unlicensed" || lc.riskCategory === "network-copyleft" ? import_chalk10.default.red : import_chalk10.default.yellow;
+  return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
+    T.branch,
+    " ",
+    lcColor(spdx),
+    " ",
+    import_chalk10.default.dim("\u2014"),
+    " ",
+    import_chalk10.default.dim(desc)
+  ] }, "license-info");
+}
+var import_react33, import_chalk10, import_jsx_runtime11, SEVERITY_LABELS2, SEVERITY_COLORS, EVIDENCE_LIMIT2, FIXED_CHROME, DETAIL_PANE_CHROME, InteractiveResultsView, T, LICENSE_DESCRIPTIONS, FindingsSummary;
 var init_InteractiveResultsView = __esm({
   async "src/ui/components/InteractiveResultsView.tsx"() {
     "use strict";
-    import_react31 = __toESM(require_react());
+    import_react33 = __toESM(require_react());
     await init_build2();
     import_chalk10 = __toESM(require_source());
     await init_ScoreHeader();
     init_useExpandAnimation();
     await init_useTerminalSize();
-    import_jsx_runtime10 = __toESM(require_jsx_runtime());
-    SEVERITY_LABELS3 = {
+    import_jsx_runtime11 = __toESM(require_jsx_runtime());
+    SEVERITY_LABELS2 = {
       5: "CRIT",
       4: "HIGH",
       3: "MED",
@@ -41824,7 +42356,6 @@ var init_InteractiveResultsView = __esm({
     EVIDENCE_LIMIT2 = 2;
     FIXED_CHROME = 21;
     DETAIL_PANE_CHROME = 20;
-    DETAIL_EVIDENCE_LIMIT = 10;
     InteractiveResultsView = ({
       result,
       config,
@@ -41833,24 +42364,24 @@ var init_InteractiveResultsView = __esm({
       onBack,
       discoveredTotal
     }) => {
-      const flagged = (0, import_react31.useMemo)(
+      const flagged = (0, import_react33.useMemo)(
         () => result.packages.filter((p) => p.score > 0),
         [result.packages]
       );
-      const clean = (0, import_react31.useMemo)(
+      const clean = (0, import_react33.useMemo)(
         () => result.packages.filter((p) => p.score === 0),
         [result.packages]
       );
       const total = result.packages.length;
-      const [searchQuery, setSearchQuery] = (0, import_react31.useState)("");
-      const allGroups = (0, import_react31.useMemo)(() => groupPackages3(flagged), [flagged]);
+      const [searchQuery, setSearchQuery] = (0, import_react33.useState)("");
+      const allGroups = (0, import_react33.useMemo)(() => groupPackages3(flagged), [flagged]);
       const allGroupCount = allGroups.length;
-      const groups = (0, import_react31.useMemo)(() => {
+      const groups = (0, import_react33.useMemo)(() => {
         if (!searchQuery) return allGroups;
         const q = searchQuery.toLowerCase();
         return allGroups.filter((g) => g.packages.some((p) => p.name.toLowerCase().includes(q)));
       }, [allGroups, searchQuery]);
-      const severityCounts = (0, import_react31.useMemo)(() => {
+      const severityCounts = (0, import_react33.useMemo)(() => {
         const counts = {};
         for (const pkg of flagged) {
           const maxSev = pkg.findings.reduce((m, f) => Math.max(m, f.severity), 0);
@@ -41858,28 +42389,28 @@ var init_InteractiveResultsView = __esm({
         }
         return counts;
       }, [flagged]);
-      const [view, dispatchView] = (0, import_react31.useReducer)(viewReducer, {
+      const [view, dispatchView] = (0, import_react33.useReducer)(viewReducer, {
         cursor: 0,
         expandLevel: null,
         expandedIndex: null,
         viewport: 0
       });
-      const viewRef = (0, import_react31.useRef)(view);
+      const viewRef = (0, import_react33.useRef)(view);
       viewRef.current = view;
-      const [detailPane, setDetailPane] = (0, import_react31.useState)(null);
-      const detailPaneRef = (0, import_react31.useRef)(detailPane);
+      const [detailPane, setDetailPane] = (0, import_react33.useState)(null);
+      const detailPaneRef = (0, import_react33.useRef)(detailPane);
       detailPaneRef.current = detailPane;
-      const [showHelp, setShowHelp] = (0, import_react31.useState)(false);
-      const showHelpRef = (0, import_react31.useRef)(showHelp);
+      const [showHelp, setShowHelp] = (0, import_react33.useState)(false);
+      const showHelpRef = (0, import_react33.useRef)(showHelp);
       showHelpRef.current = showHelp;
-      const [searchMode, setSearchMode] = (0, import_react31.useState)(false);
-      const searchModeRef = (0, import_react31.useRef)(searchMode);
+      const [searchMode, setSearchMode] = (0, import_react33.useState)(false);
+      const searchModeRef = (0, import_react33.useRef)(searchMode);
       searchModeRef.current = searchMode;
       const { rows: termRows, cols: termCols } = useTerminalSize();
       const availableRows = Math.max(5, termRows - FIXED_CHROME);
       const innerWidth = Math.max(40, termCols - 6);
       const detailGroupIdx = detailPane?.groupIndex ?? -1;
-      const detailLines = (0, import_react31.useMemo)(() => {
+      const detailLines = (0, import_react33.useMemo)(() => {
         if (detailGroupIdx < 0) return [];
         const group = groups[detailGroupIdx];
         if (!group) return [];
@@ -41889,7 +42420,7 @@ var init_InteractiveResultsView = __esm({
       const getLevel = (idx) => {
         return view.expandedIndex === idx ? view.expandLevel : null;
       };
-      const expandTargetHeight = (0, import_react31.useMemo)(() => {
+      const expandTargetHeight = (0, import_react33.useMemo)(() => {
         if (view.expandedIndex === null || view.expandLevel === null) return 0;
         const group = groups[view.expandedIndex];
         if (!group) return 0;
@@ -41905,7 +42436,7 @@ var init_InteractiveResultsView = __esm({
         if (idx === view.expandedIndex) return 1 + animVisibleLines;
         return groupRowHeight(group, level, result.safeVersions);
       };
-      const visibleEnd = (0, import_react31.useMemo)(() => {
+      const visibleEnd = (0, import_react33.useMemo)(() => {
         let consumed = 0;
         let end = view.viewport;
         while (end < groups.length) {
@@ -41937,14 +42468,14 @@ var init_InteractiveResultsView = __esm({
         }
         return newStart;
       };
-      (0, import_react31.useEffect)(() => {
+      (0, import_react33.useEffect)(() => {
         if (groups.length === 0) return;
         const { cursor, expandedIndex, expandLevel, viewport } = viewRef.current;
         const clamped = Math.min(viewport, Math.max(0, groups.length - 1));
         const newVp = adjustViewport(cursor, expandedIndex, expandLevel, clamped);
         dispatchView({ type: "MOVE", cursor, viewport: newVp });
       }, [availableRows]);
-      (0, import_react31.useEffect)(() => {
+      (0, import_react33.useEffect)(() => {
         const dp = detailPaneRef.current;
         if (dp && detailLines.length > 0) {
           const maxScroll = Math.max(0, detailLines.length - detailContentRows);
@@ -41994,7 +42525,7 @@ var init_InteractiveResultsView = __esm({
             setDetailPane({ groupIndex: dp.groupIndex, scroll: 0 });
           } else if (input === "G") {
             setDetailPane({ groupIndex: dp.groupIndex, scroll: maxScroll });
-          } else if (input === "e" || input === "b" || key.escape) {
+          } else if (input === " " || input === "e" || input === "b" || key.escape) {
             setDetailPane(null);
           } else if (input === "q") {
             onExit();
@@ -42042,7 +42573,7 @@ var init_InteractiveResultsView = __esm({
           }
           const newVp = adjustViewport(cursor, newExpIdx, newExpLvl, vpStart);
           dispatchView({ type: "EXPAND", expandedIndex: newExpIdx, expandLevel: newExpLvl, viewport: newVp });
-        } else if (input === "e") {
+        } else if (input === " " || input === "e") {
           setDetailPane({ groupIndex: view.cursor, scroll: 0 });
         } else if (input === "/") {
           setSearchMode(true);
@@ -42055,12 +42586,13 @@ var init_InteractiveResultsView = __esm({
       const visibleGroups = groups.slice(view.viewport, visibleEnd);
       const aboveCount = view.viewport;
       const belowCount = groups.length - visibleEnd;
-      const nameCol = Math.max(20, innerWidth - 22);
+      const lcCol = 16;
+      const nameCol = Math.max(20, innerWidth - 22 - lcCol);
       const clampedCursor = groups.length > 0 ? Math.min(view.cursor, groups.length - 1) : 0;
       if (showHelp) {
         const isDetail = detailPane !== null;
-        return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: "column", children: [
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+        return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Box_default, { flexDirection: "column", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
             ScoreHeader,
             {
               score: result.score,
@@ -42071,7 +42603,7 @@ var init_InteractiveResultsView = __esm({
               severityCounts
             }
           ),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
             Box_default,
             {
               flexDirection: "column",
@@ -42081,82 +42613,82 @@ var init_InteractiveResultsView = __esm({
               paddingRight: 2,
               width: "100%",
               children: [
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { bold: true, children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { bold: true, children: [
                   import_chalk10.default.cyan("\u25C6"),
                   " Keyboard Shortcuts"
                 ] }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { bold: true, children: " Navigation" }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: "" }),
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { bold: true, children: " Navigation" }),
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                   "   ",
                   import_chalk10.default.cyan("\u2191 k"),
                   "     ",
                   import_chalk10.default.dim("Move up")
                 ] }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                   "   ",
                   import_chalk10.default.cyan("\u2193 j"),
                   "     ",
                   import_chalk10.default.dim("Move down")
                 ] }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                   "   ",
                   import_chalk10.default.cyan("g"),
                   "       ",
                   import_chalk10.default.dim("Jump to top")
                 ] }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                   "   ",
                   import_chalk10.default.cyan("G"),
                   "       ",
                   import_chalk10.default.dim("Jump to bottom")
                 ] }),
-                !isDetail && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                !isDetail && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                   "   ",
                   import_chalk10.default.cyan("PgUp"),
                   "    ",
                   import_chalk10.default.dim("Page up")
                 ] }),
-                !isDetail && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                !isDetail && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                   "   ",
                   import_chalk10.default.cyan("PgDn"),
                   "    ",
                   import_chalk10.default.dim("Page down")
                 ] }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { bold: true, children: " Actions" }),
-                !isDetail && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: "" }),
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { bold: true, children: " Actions" }),
+                !isDetail && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                   "   ",
                   import_chalk10.default.cyan("\u23CE"),
                   "       ",
                   import_chalk10.default.dim("Toggle summary")
                 ] }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
+                  "   ",
+                  import_chalk10.default.cyan("space"),
                   "   ",
-                  import_chalk10.default.cyan("e"),
-                  "       ",
                   import_chalk10.default.dim(isDetail ? "Back to list" : "Open detail view")
                 ] }),
-                !isDetail && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                !isDetail && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                   "   ",
                   import_chalk10.default.cyan("/"),
                   "       ",
                   import_chalk10.default.dim("Search packages")
                 ] }),
-                !isDetail && onBack && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                !isDetail && onBack && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                   "   ",
                   import_chalk10.default.cyan("b"),
                   "       ",
                   import_chalk10.default.dim("Back to project selector")
                 ] }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                   "   ",
                   import_chalk10.default.cyan("q"),
                   "       ",
                   import_chalk10.default.dim("Quit")
                 ] }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: "" }),
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
                   " Press ",
                   import_chalk10.default.bold.cyan("?"),
                   " or ",
@@ -42174,13 +42706,13 @@ var init_InteractiveResultsView = __esm({
           setDetailPane(null);
         } else {
           const dpRep = dpGroup.packages[0];
-          const { color: dpColor } = actionBadge3(dpRep.score, config);
+          const { color: dpColor } = actionBadge3(dpRep.score);
           const dpScroll = detailPane.scroll;
           const dpAbove = dpScroll;
           const dpBelow = Math.max(0, detailLines.length - dpScroll - detailContentRows);
           const dpVisible = detailLines.slice(dpScroll, dpScroll + detailContentRows);
-          return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: "column", children: [
-            /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+          return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Box_default, { flexDirection: "column", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
               ScoreHeader,
               {
                 score: result.score,
@@ -42191,7 +42723,7 @@ var init_InteractiveResultsView = __esm({
                 severityCounts
               }
             ),
-            /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
+            /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
               Box_default,
               {
                 flexDirection: "column",
@@ -42201,18 +42733,21 @@ var init_InteractiveResultsView = __esm({
                 paddingRight: 1,
                 width: "100%",
                 children: [
-                  /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { justifyContent: "space-between", children: [
-                    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { bold: true, children: groupNames(dpGroup) }),
-                    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: dpColor(`score ${dpRep.score}`) })
+                  /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Box_default, { justifyContent: "space-between", children: [
+                    /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { bold: true, children: [
+                      groupNames(dpGroup),
+                      dpRep.license ? import_chalk10.default.dim(" \xB7 ") + (dpRep.license.riskCategory === "permissive" ? import_chalk10.default.green(dpRep.license.spdx ?? dpRep.license.raw ?? "") : dpRep.license.riskCategory === "no-license" || dpRep.license.riskCategory === "network-copyleft" ? import_chalk10.default.red(dpRep.license.spdx ?? dpRep.license.raw ?? "No license") : import_chalk10.default.yellow(dpRep.license.spdx ?? dpRep.license.raw ?? "")) : ""
+                    ] }),
+                    /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: dpColor(`score ${dpRep.score}`) })
                   ] }),
-                  dpAbove > 0 && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+                  dpAbove > 0 && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
                     import_chalk10.default.cyan(" \u2191"),
                     " ",
                     dpAbove,
                     " more above"
                   ] }),
-                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { flexDirection: "column", marginLeft: 2, children: dpVisible }),
-                  dpBelow > 0 && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+                  /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Box_default, { flexDirection: "column", marginLeft: 2, children: dpVisible }),
+                  dpBelow > 0 && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
                     import_chalk10.default.cyan(" \u2193"),
                     " ",
                     dpBelow,
@@ -42221,7 +42756,7 @@ var init_InteractiveResultsView = __esm({
                 ]
               }
             ),
-            /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
+            /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
               Box_default,
               {
                 flexDirection: "column",
@@ -42231,36 +42766,31 @@ var init_InteractiveResultsView = __esm({
                 paddingRight: 1,
                 width: "100%",
                 children: [
-                  clean.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                  clean.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                     import_chalk10.default.green("\u2713"),
                     " ",
                     import_chalk10.default.green.bold(String(clean.length)),
                     " ",
                     import_chalk10.default.dim(`package${clean.length !== 1 ? "s" : ""} passed with score 0`)
                   ] }),
-                  /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { justifyContent: "space-between", children: [
-                    /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+                  /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Box_default, { justifyContent: "space-between", children: [
+                    /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
                       (durationMs / 1e3).toFixed(1),
                       "s"
                     ] }),
-                    result.trialScansRemaining !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
-                      result.trialScansRemaining,
-                      " free scan",
-                      result.trialScansRemaining !== 1 ? "s" : "",
-                      " remaining"
-                    ] })
+                    result.trialScansRemaining !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { dimColor: true, children: "Free tier \xB7 dg login for finding details" })
                   ] })
                 ]
               }
             ),
-            /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: import_chalk10.default.dim("\u2500".repeat(Math.min(60, termCols - 4))) }),
-            /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { dimColor: true, children: import_chalk10.default.dim("\u2500".repeat(Math.min(60, termCols - 4))) }),
+            /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
               " ",
               import_chalk10.default.bold.cyan("\u2191\u2193"),
               " ",
               import_chalk10.default.dim("scroll"),
               "   ",
-              import_chalk10.default.bold.cyan("e"),
+              import_chalk10.default.bold.cyan("space"),
               " ",
               import_chalk10.default.dim("back"),
               "   ",
@@ -42271,8 +42801,8 @@ var init_InteractiveResultsView = __esm({
           ] });
         }
       }
-      return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: "column", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+      return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Box_default, { flexDirection: "column", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
           ScoreHeader,
           {
             score: result.score,
@@ -42283,7 +42813,7 @@ var init_InteractiveResultsView = __esm({
             severityCounts
           }
         ),
-        groups.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
+        groups.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
           Box_default,
           {
             flexDirection: "column",
@@ -42293,11 +42823,11 @@ var init_InteractiveResultsView = __esm({
             paddingRight: 1,
             width: "100%",
             children: [
-              /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { justifyContent: "space-between", children: [
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { bold: true, children: "Flagged Packages" }),
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: searchQuery ? `${groups.length} of ${allGroupCount}` : `${clampedCursor + 1}/${groups.length}` })
+              /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Box_default, { justifyContent: "space-between", children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { bold: true, children: "Flagged Packages" }),
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { dimColor: true, children: searchQuery ? `${groups.length} of ${allGroupCount}` : `${clampedCursor + 1}/${groups.length}` })
               ] }),
-              aboveCount > 0 && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+              aboveCount > 0 && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
                 import_chalk10.default.cyan(" \u2191"),
                 " ",
                 aboveCount,
@@ -42308,24 +42838,29 @@ var init_InteractiveResultsView = __esm({
                 const isCursor = globalIdx === clampedCursor;
                 const level = getLevel(globalIdx);
                 const rep = group.packages[0];
-                const { label, color } = actionBadge3(rep.score, config);
+                const { label, color } = actionBadge3(rep.score);
                 const names = groupNames(group);
                 const chevron = level !== null ? "\u25BE" : "\u25B8";
                 const scoreStr = String(rep.score);
-                return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: "column", children: [
-                  isCursor ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                const lcInfo = rep.license;
+                const lcStr = lcInfo ? truncate3(lcInfo.spdx ?? lcInfo.raw ?? "", lcCol - 2) : "";
+                const lcColor = !lcInfo ? import_chalk10.default.dim : lcInfo.riskCategory === "permissive" ? import_chalk10.default.green : lcInfo.riskCategory === "no-license" || lcInfo.riskCategory === "unlicensed" || lcInfo.riskCategory === "network-copyleft" ? import_chalk10.default.red : import_chalk10.default.yellow;
+                return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Box_default, { flexDirection: "column", children: [
+                  isCursor ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                     import_chalk10.default.cyan("\u258C"),
                     ` ${chevron}  `,
                     color(pad3(label, 6)),
                     import_chalk10.default.bold(pad3(truncate3(names, nameCol - 2), nameCol)),
+                    lcColor(pad3(lcStr, lcCol)),
                     color(scoreStr.padStart(3))
-                  ] }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+                  ] }) : /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                     `  ${import_chalk10.default.dim(chevron)}  `,
                     color(pad3(label, 6)),
                     pad3(truncate3(names, nameCol - 2), nameCol),
+                    lcColor(pad3(lcStr, lcCol)),
                     color(scoreStr.padStart(3))
                   ] }),
-                  level === "summary" && /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+                  level === "summary" && /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
                     FindingsSummary,
                     {
                       group,
@@ -42335,7 +42870,7 @@ var init_InteractiveResultsView = __esm({
                   )
                 ] }, group.key);
               }),
-              belowCount > 0 && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+              belowCount > 0 && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
                 import_chalk10.default.cyan(" \u2193"),
                 " ",
                 belowCount,
@@ -42344,7 +42879,7 @@ var init_InteractiveResultsView = __esm({
             ]
           }
         ),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
           Box_default,
           {
             flexDirection: "column",
@@ -42354,14 +42889,14 @@ var init_InteractiveResultsView = __esm({
             paddingRight: 1,
             width: "100%",
             children: [
-              clean.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+              clean.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
                 import_chalk10.default.green("\u2713"),
                 " ",
                 import_chalk10.default.green.bold(String(clean.length)),
                 " ",
                 import_chalk10.default.dim(`package${clean.length !== 1 ? "s" : ""} passed with score 0`)
               ] }),
-              discoveredTotal !== void 0 && discoveredTotal > total && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+              discoveredTotal !== void 0 && discoveredTotal > total && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
                 "Scanned ",
                 total,
                 " of ",
@@ -42369,23 +42904,18 @@ var init_InteractiveResultsView = __esm({
                 " packages ",
                 import_chalk10.default.dim("\u2014 dg login for full scans")
               ] }),
-              /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { justifyContent: "space-between", children: [
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+              /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Box_default, { justifyContent: "space-between", children: [
+                /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
                   (durationMs / 1e3).toFixed(1),
                   "s"
                 ] }),
-                result.trialScansRemaining !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
-                  result.trialScansRemaining,
-                  " free scan",
-                  result.trialScansRemaining !== 1 ? "s" : "",
-                  " remaining"
-                ] })
+                result.trialScansRemaining !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { dimColor: true, children: "Free tier \xB7 dg login for finding details" })
               ] })
             ]
           }
         ),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: import_chalk10.default.dim("\u2500".repeat(Math.min(60, termCols - 4))) }),
-        searchMode ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { dimColor: true, children: import_chalk10.default.dim("\u2500".repeat(Math.min(60, termCols - 4))) }),
+        searchMode ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
           " ",
           import_chalk10.default.bold.cyan("/"),
           " ",
@@ -42393,9 +42923,9 @@ var init_InteractiveResultsView = __esm({
           import_chalk10.default.cyan("\u2588"),
           "   ",
           import_chalk10.default.dim("Esc clear")
-        ] }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+        ] }) : /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
           " ",
-          groups.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
+          groups.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
             import_chalk10.default.bold.cyan("\u2191\u2193"),
             " ",
             import_chalk10.default.dim("navigate"),
@@ -42404,7 +42934,7 @@ var init_InteractiveResultsView = __esm({
             " ",
             import_chalk10.default.dim("toggle"),
             "   ",
-            import_chalk10.default.bold.cyan("e"),
+            import_chalk10.default.bold.cyan("space"),
             " ",
             import_chalk10.default.dim("detail"),
             "   ",
@@ -42416,7 +42946,7 @@ var init_InteractiveResultsView = __esm({
             " ",
             import_chalk10.default.dim("help"),
             "   ",
-            onBack && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
+            onBack && /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
               import_chalk10.default.bold.cyan("b"),
               " ",
               import_chalk10.default.dim("back"),
@@ -42425,7 +42955,7 @@ var init_InteractiveResultsView = __esm({
             import_chalk10.default.bold.cyan("q"),
             " ",
             import_chalk10.default.dim("quit")
-          ] }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
+          ] }) : /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
             "Press ",
             import_chalk10.default.bold.cyan("q"),
             " or ",
@@ -42442,16 +42972,28 @@ var init_InteractiveResultsView = __esm({
       pipe: import_chalk10.default.dim("\u2502"),
       blank: " "
     };
+    LICENSE_DESCRIPTIONS = {
+      "permissive": "Permissive \u2014 free to use, modify, and distribute. Include the copyright notice.",
+      "weak-copyleft": "Weak copyleft \u2014 changes to this library must be shared, but your code stays private.",
+      "strong-copyleft": "Strong copyleft \u2014 your entire project must be open-sourced under the same license.",
+      "network-copyleft": "Network copyleft \u2014 even SaaS/server use requires releasing your source code.",
+      "no-license": "No license found \u2014 legally all rights reserved. Use may require permission from the author.",
+      "unlicensed": "Explicitly unlicensed \u2014 proprietary software. A commercial agreement is required.",
+      "unknown": "Unrecognized license \u2014 have your legal team review before using.",
+      "deferred": "License declared in a file \u2014 check the LICENSE file in the package."
+    };
     FindingsSummary = ({ group, maxWidth, maxLines }) => {
       const rep = group.packages[0];
       const visibleFindings = rep.findings.filter((f) => f.severity > 1 || f.critical).sort((a, b) => b.severity - a.severity);
       const hasAffects = group.packages.length > 3;
       const allLines = [];
+      const lcLine = licenseLine(rep);
+      if (lcLine) allLines.push(lcLine);
       if (visibleFindings.length === 0 && rep.score > 0) {
         const reasons = rep.reasons ?? [];
         for (let i = 0; i < reasons.length; i++) {
           allLines.push(
-            /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
               i < reasons.length - 1 || hasAffects ? T.branch : T.branch,
               " ",
               truncate3(reasons[i], maxWidth - 8)
@@ -42459,7 +43001,7 @@ var init_InteractiveResultsView = __esm({
           );
         }
         allLines.push(
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
             import_chalk10.default.yellow("   \u2192"),
             " ",
             import_chalk10.default.yellow("Upgrade to Pro"),
@@ -42472,10 +43014,10 @@ var init_InteractiveResultsView = __esm({
         const f = visibleFindings[idx];
         const isLast = !hasAffects && idx === visibleFindings.length - 1;
         const connector = isLast ? T.last : T.branch;
-        const sevLabel = SEVERITY_LABELS3[f.severity] ?? "INFO";
+        const sevLabel = SEVERITY_LABELS2[f.severity] ?? "INFO";
         const sevColor = SEVERITY_COLORS[f.severity] ?? SEVERITY_COLORS[1];
         allLines.push(
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
             connector,
             " ",
             sevColor(pad3(sevLabel, 5)),
@@ -42486,7 +43028,7 @@ var init_InteractiveResultsView = __esm({
       }
       if (hasAffects) {
         allLines.push(
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { dimColor: true, children: [
             T.last,
             " ",
             truncate3(affectsLine(group), maxWidth - 8)
@@ -42494,24 +43036,24 @@ var init_InteractiveResultsView = __esm({
         );
       }
       const linesToShow = maxLines !== void 0 ? allLines.slice(0, maxLines) : allLines;
-      return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { flexDirection: "column", marginLeft: 5, children: linesToShow });
+      return /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Box_default, { flexDirection: "column", marginLeft: 5, children: linesToShow });
     };
   }
 });
 
 // src/ui/components/ProjectSelector.tsx
-var import_react32, import_chalk11, import_jsx_runtime11, ProjectSelector;
+var import_react34, import_chalk11, import_jsx_runtime12, ProjectSelector;
 var init_ProjectSelector = __esm({
   async "src/ui/components/ProjectSelector.tsx"() {
     "use strict";
-    import_react32 = __toESM(require_react());
+    import_react34 = __toESM(require_react());
     await init_build2();
     import_chalk11 = __toESM(require_source());
     init_sanitize();
-    import_jsx_runtime11 = __toESM(require_jsx_runtime());
+    import_jsx_runtime12 = __toESM(require_jsx_runtime());
     ProjectSelector = ({ projects, onConfirm, onCancel }) => {
-      const [cursor, setCursor] = (0, import_react32.useState)(0);
-      const [selected, setSelected] = (0, import_react32.useState)(() => new Set(projects.map((_, i) => i)));
+      const [cursor, setCursor] = (0, import_react34.useState)(0);
+      const [selected, setSelected] = (0, import_react34.useState)(() => new Set(projects.map((_, i) => i)));
       use_input_default((input, key) => {
         if (key.upArrow) {
           setCursor((c) => Math.max(0, c - 1));
@@ -42537,26 +43079,26 @@ var init_ProjectSelector = __esm({
         }
       });
       const ecosystemLabel = (eco) => eco === "npm" ? import_chalk11.default.magenta("npm") : import_chalk11.default.blue("pip");
-      return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Box_default, { flexDirection: "column", paddingLeft: 1, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
+      return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(Box_default, { flexDirection: "column", paddingLeft: 1, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(Text, { children: [
           import_chalk11.default.cyan("\u25C6"),
           " ",
           import_chalk11.default.bold("Dependency Guardian")
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: "" }),
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { bold: true, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Text, { children: "" }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(Text, { bold: true, children: [
           "Found ",
           projects.length,
           " project",
           projects.length !== 1 ? "s" : ""
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: "" }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Text, { children: "" }),
         projects.map((proj, i) => {
           const isCursor = i === cursor;
           const isSelected = selected.has(i);
           const prefix = isCursor ? import_chalk11.default.cyan("\u258C") : " ";
           const check = isSelected ? import_chalk11.default.green("\u25C9") : import_chalk11.default.dim("\u25CB");
-          return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
+          return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(Text, { children: [
             prefix,
             check,
             "  ",
@@ -42568,10 +43110,10 @@ var init_ProjectSelector = __esm({
             " packages"
           ] }, i);
         }),
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: "" }),
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { dimColor: true, children: selected.size === 0 ? import_chalk11.default.yellow("Select at least 1 project to scan") : `${selected.size} of ${projects.length} selected` }),
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Text, { children: "" }),
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(Text, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Text, { children: "" }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Text, { dimColor: true, children: selected.size === 0 ? import_chalk11.default.yellow("Select at least 1 project to scan") : `${selected.size} of ${projects.length} selected` }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Text, { children: "" }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(Text, { children: [
           import_chalk11.default.bold.cyan("space"),
           " ",
           import_chalk11.default.dim("toggle"),
@@ -42580,9 +43122,9 @@ var init_ProjectSelector = __esm({
           " ",
           import_chalk11.default.dim("all"),
           "   ",
-          import_chalk11.default.bold.cyan("\u23CE"),
+          import_chalk11.default.bold.hex("#FFD700")("\u23CE"),
           " ",
-          import_chalk11.default.dim("scan"),
+          import_chalk11.default.bold.hex("#FFD700")("scan"),
           "   ",
           import_chalk11.default.bold.cyan("q"),
           " ",
@@ -42598,11 +43140,11 @@ var App_exports = {};
 __export(App_exports, {
   App: () => App2
 });
-var import_react33, import_jsx_runtime12, App2;
+var import_react35, import_jsx_runtime13, App2;
 var init_App2 = __esm({
   async "src/ui/App.tsx"() {
     "use strict";
-    import_react33 = __toESM(require_react());
+    import_react35 = __toESM(require_react());
     await init_build2();
     init_useScan();
     await init_Spinner();
@@ -42611,17 +43153,19 @@ var init_App2 = __esm({
     await init_ErrorView();
     await init_ProjectSelector();
     await init_useTerminalSize();
-    import_jsx_runtime12 = __toESM(require_jsx_runtime());
+    import_jsx_runtime13 = __toESM(require_jsx_runtime());
     App2 = ({ config }) => {
       const { state, scanSelectedProjects, restartSelection } = useScan(config);
       const { exit } = use_app_default();
       useTerminalSize();
-      const prevPhaseRef = (0, import_react33.useRef)(state.phase);
-      const altScreenActiveRef = (0, import_react33.useRef)(false);
-      (0, import_react33.useEffect)(() => {
+      const prevPhaseRef = (0, import_react35.useRef)(state.phase);
+      const altScreenActiveRef = (0, import_react35.useRef)(false);
+      (0, import_react35.useEffect)(() => {
         if (!process.stdout.isTTY) return;
         process.stdout.write("\x1B[?1049h");
         process.stdout.write("\x1B[2J\x1B[H");
+        process.stdout.write("\x1B[?1003l");
+        process.stdout.write("\x1B[?1000l");
         altScreenActiveRef.current = true;
         return () => {
           if (altScreenActiveRef.current) {
@@ -42631,20 +43175,20 @@ var init_App2 = __esm({
           process.stdout.write("\x1B[?25h");
         };
       }, []);
-      (0, import_react33.useEffect)(() => {
+      (0, import_react35.useEffect)(() => {
         if (prevPhaseRef.current !== state.phase && process.stdout.isTTY) {
           process.stdout.write("\x1B[2J\x1B[H");
         }
         prevPhaseRef.current = state.phase;
       }, [state.phase]);
-      const leaveAltScreen = (0, import_react33.useCallback)(() => {
+      const leaveAltScreen = (0, import_react35.useCallback)(() => {
         if (altScreenActiveRef.current && process.stdout.isTTY) {
           process.stdout.write("\x1B[?1049l");
           altScreenActiveRef.current = false;
         }
         process.stdout.write("\x1B[?25h");
       }, []);
-      const handleResultsExit = (0, import_react33.useCallback)(() => {
+      const handleResultsExit = (0, import_react35.useCallback)(() => {
         if (state.phase === "results") {
           const { result } = state;
           if (result.action === "block" && config.mode === "block") {
@@ -42658,13 +43202,13 @@ var init_App2 = __esm({
         leaveAltScreen();
         exit();
       }, [state, config, exit, leaveAltScreen]);
-      const exitWithMessage = (0, import_react33.useCallback)((message, exitCode) => {
+      const exitWithMessage = (0, import_react35.useCallback)((message, exitCode) => {
         process.exitCode = exitCode;
         leaveAltScreen();
         process.stderr.write(message);
         return setTimeout(() => exit(), 0);
       }, [exit, leaveAltScreen]);
-      (0, import_react33.useEffect)(() => {
+      (0, import_react35.useEffect)(() => {
         if (state.phase === "empty") {
           const timer = exitWithMessage(`${state.message}
 `, 0);
@@ -42676,10 +43220,15 @@ var init_App2 = __esm({
           return () => clearTimeout(timer);
         }
         if (state.phase === "trial_exhausted") {
-          const timer = exitWithMessage(
-            "Free trial scans used up. Run `dg login` to create a free account and continue scanning.\n",
-            1
-          );
+          let msg = "Free trial scans used up. Run `dg login` to create a free account and continue scanning.\n";
+          try {
+            const { getStoredApiKey: getStoredApiKey2 } = (init_auth(), __toCommonJS(auth_exports));
+            if (getStoredApiKey2()) {
+              msg = "Your API key may be invalid or expired. Run `dg logout` then `dg login` to re-authenticate.\n";
+            }
+          } catch {
+          }
+          const timer = exitWithMessage(msg, 1);
           return () => clearTimeout(timer);
         }
       }, [state, exitWithMessage]);
@@ -42695,9 +43244,9 @@ var init_App2 = __esm({
       const content = (() => {
         switch (state.phase) {
           case "discovering":
-            return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Spinner2, { label: `Searching for dependencies in ${process.cwd()} ...` });
+            return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Spinner2, { label: `Searching for dependencies in ${process.cwd()} ...` });
           case "selecting":
-            return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+            return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
               ProjectSelector,
               {
                 projects: state.projects,
@@ -42710,7 +43259,7 @@ var init_App2 = __esm({
               }
             );
           case "scanning":
-            return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+            return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
               ProgressBar,
               {
                 value: state.done,
@@ -42719,7 +43268,7 @@ var init_App2 = __esm({
               }
             );
           case "results":
-            return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+            return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
               InteractiveResultsView,
               {
                 result: state.result,
@@ -42731,21 +43280,37 @@ var init_App2 = __esm({
               }
             );
           case "empty":
-            return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Text, { dimColor: true, children: state.message });
+            return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { dimColor: true, children: state.message });
           case "error":
-            return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(ErrorView, { error: state.error });
-          case "trial_exhausted":
-            return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(Box_default, { flexDirection: "column", paddingLeft: 2, children: [
-              /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Text, { color: "yellow", bold: true, children: "Free trial scans used up." }),
-              /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(Text, { children: [
+            return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(ErrorView, { error: state.error });
+          case "trial_exhausted": {
+            let hasKey = false;
+            try {
+              const { getStoredApiKey: getStoredApiKey2 } = (init_auth(), __toCommonJS(auth_exports));
+              hasKey = !!getStoredApiKey2();
+            } catch {
+            }
+            return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Box_default, { flexDirection: "column", paddingLeft: 2, children: hasKey ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_jsx_runtime13.Fragment, { children: [
+              /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { color: "yellow", bold: true, children: "Your API key may be invalid or expired." }),
+              /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(Text, { children: [
+                "Run ",
+                /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { color: "cyan", bold: true, children: "dg logout" }),
+                " then ",
+                /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { color: "cyan", bold: true, children: "dg login" }),
+                " to re-authenticate."
+              ] })
+            ] }) : /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_jsx_runtime13.Fragment, { children: [
+              /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { color: "yellow", bold: true, children: "Free trial scans used up." }),
+              /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(Text, { children: [
                 "Run ",
-                /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Text, { color: "cyan", bold: true, children: "dg login" }),
+                /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { color: "cyan", bold: true, children: "dg login" }),
                 " to create a free account and continue scanning."
               ] })
-            ] });
+            ] }) });
+          }
         }
       })();
-      return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Box_default, { flexDirection: "column", children: content });
+      return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Box_default, { flexDirection: "column", children: content });
     };
   }
 });
@@ -42876,6 +43441,23 @@ async function runUpdate(currentVersion) {
 
 // src/bin.ts
 var CLI_VERSION = getVersion();
+function closestCommand(input, commands) {
+  let best = "", bestDist = Infinity;
+  for (const cmd of commands) {
+    const m = input.length, n = cmd.length;
+    const dp = Array.from({ length: m + 1 }, () => new Array(n + 1));
+    for (let i = 0; i <= m; i++) dp[i][0] = i;
+    for (let j = 0; j <= n; j++) dp[0][j] = j;
+    for (let i = 1; i <= m; i++)
+      for (let j = 1; j <= n; j++)
+        dp[i][j] = input[i - 1] === cmd[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
+    if (dp[m][n] < bestDist) {
+      bestDist = dp[m][n];
+      best = cmd;
+    }
+  }
+  return bestDist <= 3 ? best : null;
+}
 process.on("SIGINT", () => {
   process.stderr.write("\n");
   process.exit(130);
@@ -42900,9 +43482,9 @@ async function main() {
   if (rawCommand === "login") {
     if (isInteractive) {
       const { render: render3 } = await init_build2().then(() => build_exports);
-      const React18 = await Promise.resolve().then(() => __toESM(require_react()));
+      const React19 = await Promise.resolve().then(() => __toESM(require_react()));
       const { LoginApp: LoginApp2 } = await init_LoginApp().then(() => LoginApp_exports);
-      const { waitUntilExit } = render3(React18.createElement(LoginApp2));
+      const { waitUntilExit } = render3(React19.createElement(LoginApp2));
       await waitUntilExit();
     } else {
       const { runStaticLogin: runStaticLogin2 } = await Promise.resolve().then(() => (init_static_output(), static_output_exports));
@@ -42926,12 +43508,29 @@ async function main() {
     process.stderr.write(chalk10.green("  Logged out.\n"));
     return;
   }
-  const config = parseConfig(process.argv);
+  const KNOWN_COMMANDS = ["scan", "npm", "pip", "wrap", "login", "hook", "update", "logout"];
+  if (rawCommand && !rawCommand.startsWith("-") && !KNOWN_COMMANDS.includes(rawCommand)) {
+    const chalk10 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+    const best = closestCommand(rawCommand, KNOWN_COMMANDS);
+    const hint = best ? ` Did you mean '${best}'?` : "";
+    process.stderr.write(`
+  ${chalk10.bold.red("Error:")} Unknown command '${rawCommand}'.${hint}
+`);
+    process.stderr.write(chalk10.dim(`  Run 'dg --help' for available commands.
+
+`));
+    process.exit(1);
+  }
+  const strictFlags = rawCommand !== "npm" && rawCommand !== "pip";
+  const config = parseConfig(process.argv, strictFlags);
   const updatePromise = checkForUpdate(CLI_VERSION).catch(() => null);
   if (config.json || !isInteractive) {
     if (rawCommand === "npm") {
       const { runStaticNpm: runStaticNpm2 } = await Promise.resolve().then(() => (init_static_output(), static_output_exports));
       await runStaticNpm2(process.argv.slice(3), config);
+    } else if (rawCommand === "pip") {
+      const { runStaticPip: runStaticPip2 } = await Promise.resolve().then(() => (init_static_output(), static_output_exports));
+      await runStaticPip2(process.argv.slice(3), config);
     } else {
       const { runStatic: runStatic2 } = await Promise.resolve().then(() => (init_static_output(), static_output_exports));
       await runStatic2(config);
@@ -42944,11 +43543,17 @@ async function main() {
     return;
   }
   const { render: render2 } = await init_build2().then(() => build_exports);
-  const React17 = await Promise.resolve().then(() => __toESM(require_react()));
+  const React18 = await Promise.resolve().then(() => __toESM(require_react()));
   if (rawCommand === "npm") {
     const { NpmWrapperApp: NpmWrapperApp2 } = await init_NpmWrapperApp().then(() => NpmWrapperApp_exports);
     const { waitUntilExit } = render2(
-      React17.createElement(NpmWrapperApp2, { config, npmArgs: process.argv.slice(3) })
+      React18.createElement(NpmWrapperApp2, { config, npmArgs: process.argv.slice(3) })
+    );
+    await waitUntilExit();
+  } else if (rawCommand === "pip") {
+    const { PipWrapperApp: PipWrapperApp2 } = await init_PipWrapperApp().then(() => PipWrapperApp_exports);
+    const { waitUntilExit } = render2(
+      React18.createElement(PipWrapperApp2, { config, pipArgs: process.argv.slice(3) })
     );
     await waitUntilExit();
   } else {
@@ -42959,7 +43564,7 @@ async function main() {
     }
     const { App: App3 } = await init_App2().then(() => App_exports);
     const { waitUntilExit } = render2(
-      React17.createElement(App3, { config })
+      React18.createElement(App3, { config })
     );
     await waitUntilExit();
   }
@@ -42970,17 +43575,25 @@ async function main() {
   }
 }
 main().catch((err) => {
-  try {
-    const chalk10 = require_source();
-    process.stderr.write(`
+  if (process.argv.includes("--json")) {
+    process.stdout.write(JSON.stringify({
+      error: true,
+      code: err.statusCode ? "api_error" : "internal_error",
+      message: err.message
+    }, null, 2) + "\n");
+  } else {
+    try {
+      const chalk10 = require_source();
+      process.stderr.write(`
   ${chalk10.bold.red("Error:")} ${err.message}
 
 `);
-  } catch {
-    process.stderr.write(`
+    } catch {
+      process.stderr.write(`
   Error: ${err.message}
 
 `);
+    }
   }
   process.exit(3);
 });